DigiCert disclosed that an internal business system used for archiving customer information was moved to a different network segment in February 2025, unintentionally exposing it to the internet. Attackers exploited a self-registration feature in the system’s account manager, which did not require MFA, to create a read-only account that accessed archived data from June 27 to July 2. DigiCert blocked the unauthorized account on July 2 and later determined that the account accessed names, email addresses, phone numbers, business addresses and, in some cases, driver’s licenses, passports, utility bills and other documents containing a name and address. The breach could not write records, act as a validation approver, or issue certificates, and the CA systems on separate secure network segments were not affected. DigiCert has added monitoring, removed remaining non-DigiCert accounts, reset passwords, deactivated self-registration and verified permission policies. 1