Certificate authority DigiCert said an internal business system that was left reachable from the internet after a February 2025 migration was later accessed without authorization, exposing some archived customer contact information and, in some cases, identity documents^1,2.

The Utah-based firm described the incident in a post-mortem on Mozilla's Bugzilla platform, according to The Record and BleepingComputer^1,2. DigiCert said the system had been moved out of a VPN-restricted network in February 2025^1,2.

The company said it determined on June 21, 2026, that the system was externally accessible when that was not intended and that an unassigned account had been created, with access restricted by July 2^1,2. BleepingComputer reported that the exposed system included a self-registration feature intended for other applications and an authorization flaw that allowed those accounts read-only access to archived customer information².

DigiCert said it first treated the matter as an account-creation issue rather than data access². On Oct. 19, a further review confirmed that an unauthorized account accessed customer information between June 27 and July 2, 2026, which the company called a reportable event under rules from Mozilla, Google Chrome, Microsoft and Apple^1,2.

Accessed records included customer names, business email addresses, phone numbers and business addresses, and for some people documents such as driver's licenses, passports or utility bills, the outlets reported^1,2. Neither report stated how many customers were affected^1,2. BleepingComputer said DigiCert described the impact as a small portion of archived customer data and had begun sending notifications².

The company said the unauthorized account could not modify records, approve validations or issue certificates, and that certificate authority services, customer login credentials and issued certificates were not compromised^1,2. The Record quoted a DigiCert spokesperson saying, "To our knowledge, there is no evidence of misuse of the information involved"¹. The spokesperson also said the incident was reported to law enforcement¹.

DigiCert said the migration was treated as an infrastructure change rather than a security change, which delayed a fuller review, and that alerting for new accounts and request volume was insufficient¹. The company said it has restricted access, disabled self-registration and added controls². What remains unknown includes the number of people affected and whether identity documents were used after the access^1,2.