DigiCert has disclosed a data breach impacting its business customers’ contact information, including names and email addresses.
The incident involved an internal business system used for archiving customer information, which was moved to a different network segment in February 2025, inadvertently becoming exposed to the internet.
Attackers abused a self-registration feature in the system’s account manager, built for other purposes and not requiring MFA, to create a read-only account that had access to archived data between June 27 and July 2.
DigiCert blocked the unauthorized account on July 2, and determined in October that the account was used to access archived customer contact information, including names, email addresses, phone numbers, and business addresses.
In some cases, driver’s licenses, passports, utility bills, and other documents containing a name and address that its customers provided were also compromised.
“The access could not write records, act as a validation approver, or issue certificates,” DigiCert says. “The CA systems operate on their own secure network segments and were not affected by this external access.”
According to the company, the incident was initially investigated and remediated as an account-creation event. On October 12, however, it started suspecting that the unauthorized account may have accessed archived data, and launched an investigation.
Since mid-October, the company also implemented additional monitoring and alerting, verified or removed remaining non-DigiCert accounts, reset passwords for all business system users, deactivated the feature that enabled users to self-register, and verified the ownership of the business system and the enforcement of permission policies.
DigiCert did not say how many customers might have been affected. SecurityWeek has emailed the company for information on the matter and will update this article if it responds.
Related: Malicious cPGuard Updates Served in OpsShield Supply Chain Attack
Related: Frontline Education Data Breach Impacts Over 1.3 Million
Related: Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk
Related: Revolve Data Breach Impacts at Least 200,000 People
