DigiCert archived customer validation records read by a self-registered account
DigiCert disclosed in a Mozilla Bugzilla incident report on October 21, 2026 that an internal business system archiving information customers provide to validate their identity had been reachable from the internet since a February 4, 2025 migration, and that an account-registration feature let outsiders create accounts on it. Those accounts were not subject to the MFA DigiCert otherwise requires and, through a missing authorization check, could read archived data; one account did so between June 27 and July 2, 2026, which DigiCert confirmed on October 19. The data was mostly business contact details, with driver's licences, passports or utility bills for a minority of customers; certificate issuance was not affected.
- Victim
- DigiCert
- Industry
- Technology
- Country
- United States
- Intrusion began
- Jun 27, 2026
- First disclosed
- Oct 21, 2026
- Actor
- Unattributed
- Initial access
- Misconfiguration
- Identity control that failed
- Authorization
- MFA
- Not enforced on the abused account
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Anyone could register an account, and a default read-only role still reached customer identity documents. Turning off self-registration on internal systems, MFA on every account path, and authorization that denies data access to accounts with no assigned role are the controls.
Sources
- DigiCert: Unauthorized access to business system (preliminary and full incident reports), DigiCert via Mozilla Bugzilla, Oct 21, 2026
- DigiCert data breach exposes customer information, identity documents, BleepingComputer, Nov 5, 2026
Record verified Nov 5, 2026 against the sources above. Corrections: contact us.
Related incidents
- Optus customer data breach via API with broken access controls 2022 · Misconfiguration
- Cyberhaven Chrome extension hijacked through OAuth consent phishing 2024 · Consent phishing
- LAPSUS$ access to Okta support via Sitel engineer workstation 2022 · Third-party access
- Nobelium abuse of reseller delegated administrative privileges 2021 · Third-party access
Cite this record
SWI Community Team. (2026). DigiCert archived customer validation records read by a self-registered account. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-digicert-self-registered-account-archive-access/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.