Jun 21, 2026
0 new incidents, 1 with updates.
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Updated
- LivePatched
DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet
Certificate authority DigiCert disclosed in a Mozilla Bugzilla incident report that an internal business system used to archive the information customer representatives provide to validate their identity was accessed without authorization. A Feb 4 2025 migration moved the system out of a VPN-restricted network segment and made it reachable from the internet, along with an account registration feature that created accounts without MFA. An account created that way read a small proportion of archived data between about June 27 and July 2 2026, when DigiCert deployed an authorization fix. Most of the data was business contact details (names, business emails, phone numbers and addresses); for a small minority of accounts it included a document such as a driver's license, passport or utility bill. DigiCert confirmed the data access on Oct 19 2026, says no certificates were issued, modified or revoked, and that certificate operations were not affected. It has not said how many customers were affected and is notifying affected people.
DigiCert internal business system (archived customer validation data)Since Jun 27, 2026
