Certificate authority DigiCert has disclosed a data breach involving an internal business system that was left externally accessible and was later accessed by an unauthorized party. The Utah-based company did not respond to requests for comment from Recorded Future News, but it published a detailed post-mortem on Mozilla’s Bugzilla platform describing the incident.

How the exposure happened

According to the post-mortem, the problem began in February 2025, when an internal business system was moved out of a VPN-restricted network and became reachable from outside the company. DigiCert said it determined on June 21, 2026 that the system was externally accessible when it was not intended to be, and that an unassigned account had been created. The company said the issue was fixed by July 2.

DigiCert confirmed on October 19 that the database had been accessed beginning June 27 and classified the event as reportable.

What data was involved

  • Customer names
  • Business email addresses and phone numbers
  • Documents such as driver’s licenses, passports, or utility bills
  • Other related information

The disclosure does not state how many customers were affected.

Company response

A DigiCert spokesperson declined to say whether the attackers had contacted the company. The spokesperson said there is no known evidence of misuse of the information and that the incident has been reported to law enforcement. DigiCert stated that the intruders could not issue certificates or take other actions, that its certificate authority services were unaffected, and that customer login credentials were not taken.

The company said the incident was reportable under rules set by Mozilla, Google Chrome, Microsoft, and Apple.

Why it went undetected

DigiCert attributed the delay in detection to how the migration was handled. The system move was treated as an infrastructure change rather than a security change, which would have triggered a more detailed review and sign-off. The company also acknowledged that the system lacked sufficient alerting for new account creation through the externally accessible endpoint or for unusual request volume from internal endpoints.

Takeaways for security teams

This incident underscores the risk of changing network exposure during routine infrastructure work without a security review. Teams should confirm that migrations of internal applications preserve access controls, and that alerting covers account creation and anomalous traffic on any endpoint that becomes reachable from outside the network.