DigiCert, a company that vouches for website identities, reported a data breach on Mozilla's public bug tracker. It moved an internal archive system off a private network in February 2025. That left the system open to the internet. BleepingComputer reported that the only confirmed access ran from 27 June to 2 July 2026. One unauthorized account read archived data. Most of it was names, business emails, phone numbers and addresses. For a small minority of customers, it also held a driver's license, passport or utility bill.
DigiCert said it found the exposure in June 2026 and fixed it on 2 July. It confirmed the data access on 19 October. The account could not change records, approve checks or issue certificates. DigiCert says its certificate services were not affected, and logins and certificates remain secure. It has not said who created the account or how many people were affected. BleepingComputer said DigiCert got a warning about open sign-up through its security research program.
A private network was doing work that access rules should have done. A sign-up feature built for other products skipped the second login step, and new accounts could read the archive. Moving the system out from behind the VPN exposed it. DigiCert's report says access rules must not depend on network position. Buyers can ask any vendor holding ID documents: how long do you keep them, and who reviews network changes?