# DigiCert says self-registered accounts read archived customer data, including some ID documents

Source: https://startwithidentity.com/blog/2026-11-05-digicert-says-self-registered-accounts-read-archived-customer-data-including-id-documents/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

[DigiCert](https://startwithidentity.com/vendors/pki/digicert/) has begun notifying customers that an unauthorized account read archived customer data from an internal business system between about June 27 and July 2, 2026, according to its [incident report on Mozilla's Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=2084460) and [BleepingComputer](https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/). A February 2025 migration made the system, previously reachable only over VPN, externally accessible, and a self-registration feature let outsiders create accounts without MFA. Those accounts were read-only and not assigned to any application, but an authorization flaw let them reach the archive. Most records held business contact details; a small minority also held a driver's license, passport or utility bill. DigiCert says the access "could not write records, act as a validation approver, or issue certificates," and no certificates were affected. It handled a June report as an account-creation issue and confirmed a reportable data event on October 19.

## Why it matters

The control that failed is deny by default. An account with no application assigned should see nothing, and here it could read archived customer records; self-registration was also left on for a system that never needed outside users. The four months between the June report and the October confirmation came from scoping it as an account problem rather than asking what those accounts had read.

The documents are the sensitive part. A [certificate authority](https://startwithidentity.com/glossary/certificate-authority/) collects them as [identity proofing](https://startwithidentity.com/glossary/identity-proofing/) evidence when it validates who is asking for a certificate, so the archive held exactly what an impersonator wants. If you are notified, expect phishing that quotes your real orders and contacts, and confirm any certificate or validation request through your DigiCert account rather than email. For your own systems, ask how long you keep proofing documents after validation is complete.

The incident is recorded in the [Identity Breach Database](https://startwithidentity.com/breaches/incidents/2026-digicert-self-registered-account-archive-access/).

Source: [Mozilla Bugzilla (DigiCert incident report)](https://bugzilla.mozilla.org/show_bug.cgi?id=2084460), [BleepingComputer](https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/)