What happened
DigiCert reported that an internal business system was moved out of a VPN‑restricted network in February 2025, making it externally accessible. An unassigned account was created without proper alerting. From June 27 to July 2 2026 the database was accessed by an external actor, exposing customer names, business email addresses, phone numbers and scanned identity documents (driver’s licenses, passports, utility bills). DigiCert fixed the exposure on July 2, confirmed that its certificate‑issuing services were unaffected, and involved law‑enforcement. No evidence of misuse of the data was found.
Why it matters for trust and compliance
- The incident underscores the importance of continuous monitoring of account‑creation events and rigorous change‑management oversight—control objectives that map to multiple frameworks and are essential for vendor‑risk assurance.
- Demonstrates need for continuous monitoring of third‑party access controls and alerting on anomalous account activity.
- Supports audit evidence for change‑management and configuration‑review controls across frameworks.
Who is affected
Enterprises using DigiCert PKI services SaaS providers that rely on external certificate authorities Any organization storing personal identification documents with third‑party vendors
Recommended actions
- Review and tighten third‑party change‑management and configuration‑review processes.
- Implement real‑time alerts for new account creation on externally exposed assets.
- Collect and retain evidence of access‑control monitoring to satisfy audit readiness.