DigiCert says self-registered accounts read archived customer data, including some ID documents
DigiCert is notifying customers that an unauthorized, self-registered account read archived customer records from an internal business system between June 27 and July 2, 2026. Most were contact details; a small minority included driver's licenses, passports or utility bills. Certificates were not affected.
DigiCert has begun notifying customers that an unauthorized account read archived customer data from an internal business system between about June 27 and July 2, 2026, according to its incident report on Mozilla's Bugzilla and BleepingComputer. A February 2025 migration made the system, previously reachable only over VPN, externally accessible, and a self-registration feature let outsiders create accounts without MFA. Those accounts were read-only and not assigned to any application, but an authorization flaw let them reach the archive. Most records held business contact details; a small minority also held a driver's license, passport or utility bill. DigiCert says the access "could not write records, act as a validation approver, or issue certificates," and no certificates were affected. It handled a June report as an account-creation issue and confirmed a reportable data event on October 19.
Why it matters
The control that failed is deny by default. An account with no application assigned should see nothing, and here it could read archived customer records; self-registration was also left on for a system that never needed outside users. The four months between the June report and the October confirmation came from scoping it as an account problem rather than asking what those accounts had read.
The documents are the sensitive part. A certificate authority collects them as identity proofing evidence when it validates who is asking for a certificate, so the archive held exactly what an impersonator wants. If you are notified, expect phishing that quotes your real orders and contacts, and confirm any certificate or validation request through your DigiCert account rather than email. For your own systems, ask how long you keep proofing documents after validation is complete.
The incident is recorded in the Identity Breach Database.
Source: Mozilla Bugzilla (DigiCert incident report), BleepingComputer
Related on Start with Identity
- BlogWorkOS says an AI-assisted attack framework reached its internal sales tool and CRM data
WorkOS found unauthorized access on October 30 to an internal tool its sales and customer teams use, exposing CRM contacts, call and Slack excerpts, and directo
- BlogChainstack says an attacker reached production through a third-party component and took password hashes
Blockchain infrastructure provider Chainstack says an attacker entered a development environment through a third-party component on October 26, reached producti
- BlogFBI removes contractor after a missed patch led to the ShinyHunters breach of employee data
The FBI says a contractor failed to apply a patch to a third-party-managed platform, opening the way for the ShinyHunters breach of employee records. Reuters na
- CVEFreeIPA idp-add evaluates input before checking the caller's rights
Any authenticated FreeIPA principal could push --organization or --base-url values into an eval() call that ran before the access check, reading the server proc
- CVEKeycloak authorization bypass
Keycloak failed an authorization check, so a caller could reach a resource their role should have blocked. Part of the April 2024 RHSA-2024:1868 set with CVE-20
- CVEKeycloak UMA policy privilege escalation
Keycloak's UMA policy engine checked only the first resource in a request (CWE-266). Additional resources skipped the check. A privilege escalation in user-mana