DigiCert Breach Shows How a Routine System Move Can Expose Customer Data

Certificate authority DigiCert has reported a data breach after an internal business system was moved out of a VPN-restricted network, making it reachable from outside the company. According to a post-mortem the company published on Mozilla's Bugzilla platform, the change was made in February 2025. DigiCert determined in June that the system was externally accessible when that was not intended, and that an unassigned account had been created. The issue was fixed by July 2. On October 19, the company confirmed the database had been accessed from June 27 and called it a "reportable event".

The accessed data included customer names, business email addresses and phone numbers, as well as documents such as driver's licences, passports and utility bills. The report does not say how many customers were affected. DigiCert said the intruders could not issue certificates, its certificate authority services were not affected, and customer login credentials were not taken. A spokesperson said there is no evidence of misuse, and that the incident has been reported to law enforcement.

DigiCert said the problem went undetected because the migration was treated as an infrastructure change rather than a security change, which would have triggered a more detailed review and sign-off. The system also had insufficient alerting for new account creation through the exposed endpoint, or for unusual request volumes. The incident was reportable under rules set by Mozilla, Google Chrome, Microsoft and Apple.