Certificate authority DigiCert has disclosed that it suffered unauthorized access to a corporate system containing customer identity documents and personal data. The company itself reported the incident after discovering that an internal system holding identity validation information had been exposed to the internet.
The system originally operated inside a network accessible only via VPN. On 4 February 2025 it was relocated to another network segment that allowed direct internet access. Compounding the issue, the platform permitted creation of new accounts without requiring multi-factor authentication for accounts provisioned through the account manager system.
DigiCert stated it became aware on 21 June that the system was reachable from the internet and that an account had been created. On 2 July the company implemented fixes that prevented new account creation and blocked unassigned accounts from accessing stored data. At that time DigiCert was unaware that the created account had already obtained access to customer records.
On 19 October the company confirmed that unauthorized access to customer information had occurred. The exposed data primarily includes names, business email addresses, telephone numbers and business address details. For a small minority of affected accounts, additional personal documents such as passports, driver's licenses, energy bills and other name-and-address records were also accessed.
DigiCert emphasized that the certificates it issues remain secure and that the compromised account possessed no ability to issue certificates. The total number of impacted customers has not been disclosed.
