DigiCert admits external access exposed customer data, including identity documents

Certificate authority DigiCert has disclosed that an internal system became reachable from the internet and that someone accessed archived data on business customers: names, email addresses, phone numbers and addresses and, in some cases, driver's licenses, passports and utility bills, according to SecurityWeek and The Record.

According to the report the company posted on Bugzilla, Mozilla's platform, cited by The Record, the system was moved out of a VPN-restricted network in February 2025. SecurityWeek adds that the attackers used a self-registration feature without multi-factor authentication to create a read-only account, with access to data between June 27 and July 2, when it was blocked.

DigiCert maintains that the account could not write records, approve validations or issue certificates and that the certificate authority's systems, on their own network segments, were not affected. A spokesperson told The Record that it has no evidence of misuse of the data and that law enforcement has been informed.

Developing story: DigiCert has not said how many customers were affected and its spokesperson declined to say whether the attackers have contacted the company. The company's original report could not be checked directly: it is cited here through the two outlets.