DigiCert disclosed that an internal business system was unintentionally moved out of a VPN-restricted network in February 2025, making it externally accessible. The company said the exposure was identified on 2026-06-21 when an unassigned account appeared, and the issue was fixed by July 2. Records show the database was accessed from June 27, and DigiCert classified the event as reportable on October 19. Accessed data included customer names, business email addresses, phone numbers and documents such as driver’s licenses, passports or utility bills, though the number of affected customers was not disclosed. DigiCert emphasized that threat actors could not issue certificates, alter certificate-authority services, or obtain customer login credentials, and that no evidence of misuse has been found. The breach was reported to law enforcement and is subject to reporting rules from Mozilla, Google Chrome, Microsoft and Apple. 1