Utah Security Firm Discloses Unauthorized Access to Business System
Certificate authority DigiCert has disclosed that an internal business system was left accessible from the internet and was accessed by an outside party. The Utah-based security firm said in October that the database, which held customer names, business email addresses, phone numbers and identity verification documents including driver's licenses and passports, was accessed starting on 27 June. DigiCert states that the intruders could not issue certificates and that customer login credentials were not exposed, but the incident has raised questions about change-management practices at a firm that helps verify web server security.
Timeline of the Exposure and Detection
In February an internal business system was moved out of a VPN-restricted network, leaving it accessible externally. On 21 June DigiCert determined that the system was externally accessible when that was not intended and that an unassigned account had been created. DigiCert fixed the issue by 2 July.
On 19 October the company confirmed that the database was accessed starting on 27 June and classified the incident as reportable. DigiCert posted a post-mortem on Mozilla's Bugzilla platform and sent breach notifications to affected customers. The report does not state how many customers were impacted.
Data Held in the Accessed System
The accessed database contained customer names, business email addresses and phone numbers. It also held documents such as driver's licenses, passports and utility bills that customers had submitted. DigiCert states that customer login credentials were not in the system and that the threat actors could not issue certificates or take other actions.
The company said its certificate authority services were not affected. Certificate authorities help to verify the security of web servers, and the incident was reportable due to rules issued by Mozilla, Google Chrome, Microsoft and Apple.
Why the Misconfiguration Went Unnoticed
DigiCert stated that the issue was not caught sooner because the migration of the system was handled as an infrastructure change rather than a security change. According to the company, a security classification would have prompted more thorough review and formal approval.
The business system lacked adequate alerting for new account creation through the externally accessible endpoint or unusual request patterns from its internal endpoints. A spokesperson declined to say whether the attackers have contacted DigiCert, stating the company is focused on providing customers with relevant information about the incident. DigiCert reported the matter to law enforcement and stated it will support the investigation as needed.
Concerns About Identity Document Exposure
Multiple people expressed concern on social media after receiving breach notification emails from DigiCert. Several posts raised the issue of threat actors being able to tie personal documents such as IDs and passports to specific certificates.
A spokesperson told Recorded Future News that to the company's knowledge, there is no evidence of misuse of the information involved. DigiCert posted a lengthy post-mortem on Mozilla's Bugzilla platform explaining the situation but did not respond to other requests for comment.
What DigiCert Has Done Since Discovery
DigiCert closed the external access by 2 July and confirmed the unauthorized access timeline by 19 October. The company reported the incident to law enforcement. Individual notifications were sent to affected customers, though the number of impacted individuals has not been disclosed.
The public post-mortem describes the detection and timeline but does not detail changes to change-management processes or monitoring systems. The report notes that the system lacked sufficient alerting for new account creation and request volume.
Steps for Affected Customers
If you received a breach notification from DigiCert, be alert for phishing attempts that reference certificates, domain renewals or urgent security actions. Be skeptical of unsolicited messages that create urgency or ask you to log in via a provided link.
If you submitted identity documents to DigiCert for verification, consider placing a fraud alert or credit freeze with consumer reporting agencies if available in your jurisdiction. Monitor your accounts for unauthorized activity. DigiCert states that login credentials were not exposed, so an immediate password change is not required solely because of this breach, though using unique passwords for each service remains advisable.
- Watch for phishing attempts that reference certificates or urgent security actions.
- Be skeptical of unsolicited messages that create urgency or include login links.
- Consider placing a fraud alert or credit freeze if you submitted identity documents.
- Monitor your accounts for unauthorized activity.
- Use unique passwords for each service and enable two-factor authentication where available.
Questions readers ask
Were any certificates issued by the attackers who accessed the DigiCert system?
DigiCert states that the threat actors who accessed the database could not issue certificates or take other actions. The company said its certificate authority services were not affected.
What types of identity documents were in the accessed database?
The database contained documents such as driver's licenses, passports and utility bills that customers had submitted. It also held customer names, business email addresses and phone numbers. Customer login credentials were not in the system.
How long was the DigiCert system accessible before the company noticed?
The system was moved out of VPN-restricted access in February. DigiCert determined on 21 June that it was externally accessible when that was not intended. The company does not specify how long the system was exposed before that determination.
Has DigiCert said how many customers were affected by the breach?
No. The report does not state how many customers were impacted. DigiCert sent individual breach notifications to affected customers and posted a post-mortem on Mozilla's Bugzilla platform, but has not disclosed the number of people whose data was accessed.
Should I change my DigiCert account password after this incident?
DigiCert states that customer login credentials were not in the accessed system, so an immediate password change is not required solely because of this breach. However, using unique passwords for each service and enabling two-factor authentication where available is advisable as general practice.
Source and reporting limits
Based on reporting by The Record. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.