# DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet · pwn.watch > Certificate authority DigiCert disclosed in a Mozilla Bugzilla incident report that an internal business system used to archive the information customer representatives provide to validate their identity was accessed without authorization. A Feb 4 2025 migration moved the system out of a VPN-restricted network segment and made it reachable from the internet, along with an account registration feature that created accounts without MFA. An account created that way read a small proportion of archived data between about June 27 and July 2 2026, when DigiCert deployed an authorization fix. Most of the data was business contact details (names, business emails, phone numbers and addresses); for a small minority of accounts it included a document such as a driver's license, passport or utility bill. DigiCert confirmed the data access on Oct 19 2026, says no certificates were issued, modified or revoked, and that certificate operations were not affected. It has not said how many customers were affected and is notifying affected people. Page: https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026 · generated 2026-11-05T14:39:04.572Z ## Status - Severity: medium · status: live · patch: patched - Product: DigiCert internal business system (archived customer validation data) - Started: 2026-06-27 - Affected: DigiCert internal business system archiving customer validation data (externally reachable from Feb 4 2025 to Jul 2 2026) - Fixed in: DigiCert authorization fix deployed Jul 2 2026 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026.json - This file: https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026/llms.txt ## Updates (newest first) - 2026-11-05: Cyber Security News reports that DigiCert is emailing customers about the breach, reviewing identity documents to identify affected individuals, and has disabled self-registration, moved exposed endpoints behind private networking and reset business system passwords. (https://cybersecuritynews.com/digicert-confirms-data-breach/) - 2026-10-19: DigiCert confirms unauthorized access to a subset of archived data, mostly business contact details and in a small minority of accounts a driver's license, passport, utility bill or similar document, and files a self-reported incident on Mozilla Bugzilla. It says no certificates were issued, modified or revoked. (https://bugzilla.mozilla.org/show_bug.cgi?id=2084460) - 2026-07-02: DigiCert deploys an authorization fix that stops the account registration and blocks unassigned accounts from reading archived data, still unaware that some data had been accessed. (https://bugzilla.mozilla.org/show_bug.cgi?id=2084460) - 2026-06-21: DigiCert determines the system is externally accessible and that an unassigned account was created; the data access later traced to that account began around June 27. (https://bugzilla.mozilla.org/show_bug.cgi?id=2084460) - 2025-02-04: DigiCert moves the internal business system from a VPN-restricted network segment to a different availability zone, which inadvertently makes it reachable from the internet together with an account registration feature whose accounts are not subject to MFA. (https://bugzilla.mozilla.org/show_bug.cgi?id=2084460) ## Fix brief # Security brief: DigiCert says an outsider read archived customer validation data, including some passports and driver's licenses, through an internal system left reachable from the internet Source: https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026 · status: live · severity: medium · updated Nov 5, 2026, 06:43 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Certificate authority DigiCert disclosed in a Mozilla Bugzilla incident report that an internal business system used to archive the information customer representatives provide to validate their identity was accessed without authorization. A Feb 4 2025 migration moved the system out of a VPN-restricted network segment and made it reachable from the internet, along with an account registration feature that created accounts without MFA. An account created that way read a small proportion of archived data between about June 27 and July 2 2026, when DigiCert deployed an authorization fix. Most of the data was business contact details (names, business emails, phone numbers and addresses); for a small minority of accounts it included a document such as a driver's license, passport or utility bill. DigiCert confirmed the data access on Oct 19 2026, says no certificates were issued, modified or revoked, and that certificate operations were not affected. It has not said how many customers were affected and is notifying affected people. Severity detail: Read-only access to archived customer contact data and, for a small minority of accounts, identity documents; DigiCert says certificate issuance and validation were not affected and customers need not replace certificates - Product: DigiCert internal business system (archived customer validation data) ## Affected versions - DigiCert internal business system archiving customer validation data (externally reachable from Feb 4 2025 to Jul 2 2026) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - DigiCert authorization fix deployed Jul 2 2026 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Primary source: DigiCert's self-reported Mozilla Bugzilla incident 2084460 (filed ~Oct 20 per Cyber Security News). Access window ~2026-06-27 to 2026-07-02; confirmed 2026-10-19. No victim count published. Troy Hunt shared DigiCert's notification email on X on Nov 4 (exact post not captured). Re-check the Bugzilla bug for the final report and any counts. Separate from DigiCert's earlier support-chat code-signing incident (Bugzilla 2033170). ## Latest updates - Nov 5, 2026: Cyber Security News reports that DigiCert is emailing customers about the breach, reviewing identity documents to identify affected individuals, and has disabled self-registration, moved exposed endpoints behind private networking and reset business system passwords. - Oct 19, 2026: DigiCert confirms unauthorized access to a subset of archived data, mostly business contact details and in a small minority of accounts a driver's license, passport, utility bill or similar document, and files a self-reported incident on Mozilla Bugzilla. It says no certificates were issued, modified or revoked. - Jul 2, 2026: DigiCert deploys an authorization fix that stops the account registration and blocks unassigned accounts from reading archived data, still unaware that some data had been accessed. - Jun 21, 2026: DigiCert determines the system is externally accessible and that an unassigned account was created; the data access later traced to that account began around June 27. - Feb 4, 2025: DigiCert moves the internal business system from a VPN-restricted network segment to a different availability zone, which inadvertently makes it reachable from the internet together with an account registration feature whose accounts are not subject to MFA. ## Advisories - [DigiCert: Unauthorized access to business system (Bug 2084460)](https://bugzilla.mozilla.org/show_bug.cgi?id=2084460) (Mozilla Bugzilla (DigiCert incident report)) ## Write-ups & news - [DigiCert Confirms Data Breach Exposing Customer Details and Sensitive Identity Documents](https://cybersecuritynews.com/digicert-confirms-data-breach/) ## Caveats Certificates are not affected and do not need replacing. If you gave DigiCert identity documents during validation, watch for DigiCert's notification, and treat unexpected certificate revalidation emails or calls with caution, since validation contact details were exposed. --- Machine-readable: https://pwn.watch/i/digicert-business-system-validation-data-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.