Certificate authority DigiCert has acknowledged that an internal business system was reachable from the public internet for more than 16 months, and that some customer information was accessed by an unauthorized party. The Register saw the email DigiCert sent to affected people.
The exposure began in February 2025, when DigiCert moved the system from a VPN-protected network to a different availability zone. The system ran on the same account-management platform as customer-facing products, and a self-registration feature that should not have been there let outsiders create accounts without multifactor authentication. A separate permissions flaw let those accounts browse archived customer records.
DigiCert spotted the unauthorized accounts on June 18, 2026, but judged them harmless because they were not tied to any application. A researcher raised the alarm three days later, and the self-registration hole was closed on July 2. One unauthorized account accessed some archived records between June 27 and July 2.
The company began checking for real data access on October 12 and confirmed it on October 19. Exposed details include names, business email addresses, phone numbers and business addresses, and some records may hold passports, driver's licenses, utility bills or similar documents. DigiCert called the affected records a small proportion of its archive but did not say how many people are involved.