DigiCert says exposed system let intruder access archived customer records

A server migration left a DigiCert internal system exposed to the internet for more than 16 months, and an unauthorised user accessed archived customer records. The breach matters because some records included identity documents such as passports and driving licences, though DigiCert has not said how many people were affected.

The system was moved from a VPN-protected network in February 2025, and a self-registration feature let outsiders create accounts without multifactor authentication. DigiCert found unauthorised accounts on 18 June 2026, disabled self-registration on 2 July, and later confirmed that one account accessed some records between 27 June and 2 July. The company says its certificate services, customer credentials and issued certificates were unaffected; it has tightened network access and added monitoring.