DigiCert says an internal system exposed during a 2025 infrastructure migration was accessed by unauthorized users in June 2026, compromising a limited set of archived customer records. The certificate authority said its core services, issued certificates and customer credentials were not affected.
According to a disclosure filed with Mozilla, the system moved from a VPN-protected environment to an externally available zone on February 4, 2025. Self-registered accounts without multifactor authentication could then reach archived data with read-only permissions. DigiCert fixed the exposure on July 2 after identifying it on June 21, but said it did not confirm access to customer records until October 19.
The exposed material included names and business contact details. Some records also contained passports, driver’s licenses, national identity cards or utility documents used in older validation workflows. DigiCert has not disclosed the number of affected customers.
Seemant Sehgal, founder and CEO of BreachLock, said: “A system that was behind a VPN for years and then sat on the open internet for 16 months tells you the migration checklist had no step that asked what else this change exposes.”
John Strand, owner of Black Hills Information Security, criticized the gradual flow of details: “Whenever I see articles like this, I get uncomfortable with the way information trickles out from the vendor, bit by bit by bit.”
Sharon Hagi, chief security officer at Finite State, said the incident deserves attention even though DigiCert reported that its certificate operations were unaffected. “Certificate authorities are the root of trust for the connected world.”
For security teams, the central lesson is that an infrastructure move is also a security-boundary change. External reachability, account creation, authentication and archive access should be revalidated before and after any migration.