DigiCert said in its incident report on Mozilla's Bugzilla, filed as a preliminary report on 20 October 2026 and followed by a full report on 1 November 2026 (US Pacific time), that an unauthorised account accessed archived data on an internal business system that stores information customer representatives give DigiCert to validate their identity.

DigiCert says most of the data was business contact information: names, business email addresses, phone numbers and business addresses; a small minority of customer accounts also included a customer-provided document such as a driver's licence, passport, utility bill or other document with name and address.

It says the incident affected only a small proportion of archived data. DigiCert says that on 4 February 2025 the system was moved from a VPN-restricted network segment to a different availability zone, which inadvertently made it reachable from outside, and that an account-registration feature meant for other uses became available on it. Accounts registered that way were not subject to the multi-factor authentication DigiCert otherwise requires and, although read-only and not assigned to any application, could read archived data.

DigiCert says that from 21 June 2026 it determined the system was externally accessible and that an unassigned account had been created, but initially concluded the account had no data access; it released an authorisation fix on 2 July.

On 19 October it confirmed unauthorised access to a subset of archived data, and its investigation puts the access window at 27 June to 2 July 2026.

DigiCert says the account could not write records, act as a validation approver or issue certificates, that no certificates were issued, modified or revoked, and that its CA services, CertCentral and DigiCert ONE were unaffected; customer login credentials and DigiCert-issued certificates remain secure, and no action is needed regarding active certificates. DigiCert lists its fixes as blocking the registration endpoint, restricting the system to VPN traffic, deactivating self-registration, new alerting on file access and request volumes, password resets for all users of the system and an external penetration test. (source: DigiCert incident report, Mozilla Bugzilla 2084460)

BleepingComputer reported on 5 November that DigiCert has begun sending breach notifications to affected customers and quotes the notification as saying DigiCert is still reviewing identification documents and will notify those affected once that review is complete; BleepingComputer says it asked DigiCert how many people were affected. (source: BleepingComputer)

Updated (6 Nov 2026; DigiCert incident report, Mozilla Bugzilla 2084460): DigiCert's full timeline in the report puts non-DigiCert accounts first seen on 18 June 2026, when DigiCert also put the system behind a WAF that blocked new external account creation; its managed security research program reported the external account-creation path on 21 June; DigiCert verified that path on 24 June; the 2 July authorisation patch ended the data-access window (27 June to 2 July); and on 9 July the WAF restricted the business-system hostnames to VPN traffic only, apart from approved external endpoints.

DigiCert says it first suspected possible unauthorised access to the archived data on 12 October 2026 and confirmed a reportable event on 19 October.

DigiCert's Five Whys root-cause analysis in the same report attributes the incident to a network change that got no security review, monitoring that was not reassessed after the migration, and an authorisation model that never contemplated self-registered accounts; DigiCert admits: 'The incident was initially handled as an account-creation issue rather than a data-access event.'

DigiCert says the archive holds subscriber validation information, and that no certificate was issued, modified or revoked.

Two action items in the report were due 6 November 2026: item 12 (internal-audit confirmation that no origin server is externally reachable) and item 13 (review of alerting on unexpected account creation). DigiCert has since commented on the bug that item 13 is complete; as of this 6 November 2026 read, item 12 is still open. Two questions on the bug remain unanswered by DigiCert: how many records were exposed, and what triggered the 12 October suspicion. (source: DigiCert incident report, Mozilla Bugzilla 2084460)