{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet · updates",
  "home_page_url": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026",
  "feed_url": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026/feed.json",
  "description": "Certificate authority DigiCert disclosed in a Mozilla Bugzilla incident report that an internal business system used to archive the information customer representatives provide to validate their identity was accessed without authorization. A Feb 4 2025 migration moved the system out of a VPN-restricted network segment and made it reachable from the internet, along with an account registration feature that created accounts without MFA. An account created that way read a small proportion of archived data between about June 27 and July 2 2026, when DigiCert deployed an authorization fix. Most of the data was business contact details (names, business emails, phone numbers and addresses); for a small minority of accounts it included a document such as a driver's license, passport or utility bill. DigiCert confirmed the data access on Oct 19 2026, says no certificates were issued, modified or revoked, and that certificate operations were not affected. It has not said how many customers were affected and is notifying affected people.",
  "language": "en",
  "_pwn": {
    "slug": "digicert-business-system-validation-data-breach-oct-2026",
    "severity": "medium",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026#2026-11-05-7d463bb4",
      "url": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026#2026-11-05-7d463bb4",
      "title": "DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet: Cyber Security News reports that DigiCert is emailing customers about the breach, reviewing identity documents to identify affected individuals, and has disabled self-registration, moved exposed endpoints behind private networking and reset business system passwords.",
      "content_text": "DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet: Cyber Security News reports that DigiCert is emailing customers about the breach, reviewing identity documents to identify affected individuals, and has disabled self-registration, moved exposed endpoints behind private networking and reset business system passwords.\n\nSource: https://cybersecuritynews.com/digicert-confirms-data-breach/",
      "date_published": "2026-11-05T00:00:00.000Z",
      "external_url": "https://cybersecuritynews.com/digicert-confirms-data-breach/",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026#2026-10-19-49109e59",
      "url": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026#2026-10-19-49109e59",
      "title": "DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet: DigiCert confirms unauthorized access to a subset of archived data, mostly business contact details and in a small minority of accounts a driver's license, passport, utility bill or similar document, and files a self-reported incident on Mozilla Bugzilla. It says no certificates were issued, modified or revoked.",
      "content_text": "DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet: DigiCert confirms unauthorized access to a subset of archived data, mostly business contact details and in a small minority of accounts a driver's license, passport, utility bill or similar document, and files a self-reported incident on Mozilla Bugzilla. It says no certificates were issued, modified or revoked.\n\nSource: https://bugzilla.mozilla.org/show_bug.cgi?id=2084460",
      "date_published": "2026-10-19T00:00:00.000Z",
      "external_url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2084460",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026#2026-07-02-1acd40a1",
      "url": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026#2026-07-02-1acd40a1",
      "title": "DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet: DigiCert deploys an authorization fix that stops the account registration and blocks unassigned accounts from reading archived data, still unaware that some data had been accessed.",
      "content_text": "DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet: DigiCert deploys an authorization fix that stops the account registration and blocks unassigned accounts from reading archived data, still unaware that some data had been accessed.\n\nSource: https://bugzilla.mozilla.org/show_bug.cgi?id=2084460",
      "date_published": "2026-07-02T00:00:00.000Z",
      "external_url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2084460",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026#2026-06-21-0fc96a26",
      "url": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026#2026-06-21-0fc96a26",
      "title": "DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet: DigiCert determines the system is externally accessible and that an unassigned account was created; the data access later traced to that account began around June 27.",
      "content_text": "DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet: DigiCert determines the system is externally accessible and that an unassigned account was created; the data access later traced to that account began around June 27.\n\nSource: https://bugzilla.mozilla.org/show_bug.cgi?id=2084460",
      "date_published": "2026-06-21T00:00:00.000Z",
      "external_url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2084460",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026#2025-02-04-14ea89b0",
      "url": "https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026#2025-02-04-14ea89b0",
      "title": "DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet: DigiCert moves the internal business system from a VPN-restricted network segment to a different availability zone, which inadvertently makes it reachable from the internet together with an account registration feature whose accounts are not subject to MFA.",
      "content_text": "DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet: DigiCert moves the internal business system from a VPN-restricted network segment to a different availability zone, which inadvertently makes it reachable from the internet together with an account registration feature whose accounts are not subject to MFA.\n\nSource: https://bugzilla.mozilla.org/show_bug.cgi?id=2084460",
      "date_published": "2025-02-04T00:00:00.000Z",
      "external_url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2084460",
      "tags": [
        "medium"
      ]
    }
  ]
}