DigiCert, a prominent name in digital security, has revealed a security breach that compromised the contact information of its business clientele. The breach included sensitive details such as names and email addresses.
Details of the Security Incident
The breach occurred via an internal system designed for storing customer data, which became accessible online after it was relocated to a new network section in February 2025. This exposure allowed unauthorized access to the system.
Hackers exploited a feature meant for self-registration in the account management system, which lacked multi-factor authentication (MFA). This vulnerability enabled them to set up a read-only account, accessing archived customer data between June 27 and July 2.
Response and Mitigation Measures
Upon discovery on July 2, DigiCert promptly disabled the unauthorized account. By October, they concluded that the account had accessed customer contact data, including phone numbers and business addresses. In some instances, more sensitive documents like driver’s licenses and passports were also exposed.
DigiCert stated that the breach did not affect their Certificate Authority systems, which are safeguarded by separate secure networks. They treated the event initially as an account issue but later initiated a thorough investigation on October 12 to confirm data access.
Strengthening Security Protocols
In response to the breach, DigiCert has enhanced its security measures. Since mid-October, they have increased monitoring, deactivated the self-registration feature, and enforced stricter access controls. All non-DigiCert accounts were reviewed, and passwords were reset for users of the business systems.
The company has yet to disclose the total number of affected customers. Efforts to gather further details from DigiCert are ongoing, as security experts and affected parties seek more clarity on the incident.
This breach underscores the critical need for robust cybersecurity and vigilant monitoring in safeguarding customer information. DigiCert’s ongoing efforts to bolster its security infrastructure aim to prevent future incidents.
