DigiCert

DigiCert Discloses Unauthorized Access Exposing Customer Passports, Driver's Licenses and Personal Data

Certificate authority DigiCert has confirmed a data exposure incident involving customer identity documents and personal information. The company discovered unauthorized access to an internal system that stored identity validation materials supplied by customers. The affected system originally resided in a VPN-restricted network but was moved on 4 February 2025 to a publicly reachable network without proper access controls. Attackers could create accounts without multi-factor authentication, and one such account was later found to have accessed customer records. DigiCert identified the external exposure on 21 June, applied fixes on 2 July, and confirmed data access on 19 October. The incident primarily affected names, business email addresses, phone numbers and addresses, while a small subset of accounts also had copies of passports, driver's licenses, utility bills and other identity documents exposed.