A digital certificate provider has disclosed a data breach affecting information belonging to its business customers. According to The Record (Recorded Future News), in an article dated November 6, 2026, an internal company system was reachable from outside the organization when it was not meant to be. The outlet reports that someone created an unauthorized account on that system during the summer.
Key points
- The affected company reports a breach of business customer information; an internal system was reachable from the Internet without that being intended.
- An unauthorized account was created on that system during the summer, according to the company as cited by The Record.
- The affected organization is a certificate authority; the source does not specify where the incident took place.
What is known about the incident
According to The Record (Recorded Future News), a digital certificate provider reported a breach affecting business customer information. The November 6, 2026 article states that an internal system was reachable from outside when it was not meant to be, and that an unauthorized account was created on it during the summer. The source does not specify where the incident took place.
Nothing in the available information indicates that the incident occurred in Canada, so we are not presenting it as a local case. The scenario itself, however, applies here just as well.
To be clear, what follows describes a general scenario rather than the sequence of this particular incident, which the source does not detail. A tool meant for internal use ends up published to the Internet during a technical change, and the gap goes unnoticed because everything keeps working normally. A reachable service is not necessarily accessible without authorization, though, and the creation of an account does not by itself prove that information was viewed or copied.
An internal tool opened by mistake exposes customers first
An internal tool reachable from the Internet without the company’s knowledge creates a risk that extends beyond its own records. If poorly protected, it also puts customer, supplier, and employee information at stake. The cost is then measured in contracts called into question and eroded trust, not just in IT expenses.
A Quebec SME handles the same categories of information as a large company: contact details, contracts, payroll records, invoices. A business customer who learns that their information was exposed does not distinguish a configuration error from negligence. They ask themselves whether you are a reliable link in their own supply chain.
One thing should be said clearly, since the market promises a great deal: there is no such thing as absolute protection, and no provider can guarantee zero risk. Be wary of any pitch claiming otherwise. The realistic goal is to significantly reduce exposure and make this kind of scenario considerably harder to pull off.
Checks to run this week
The useful checks require no special tooling. They involve knowing what is reachable from the Internet, reviewing the list of active accounts, and deciding who gets notified in case of doubt. Leadership can launch them this week with its IT provider.
- Ask your IT provider for a written list of company systems reachable from the Internet, then have those that do not need to be closed down.
- Have leadership review the list of active accounts for each piece of software, and remove access for departed employees or ended contractor engagements.
- Instruct accounting to call a known contact before acting on any banking detail change received by email.
System inventory and account management are among the baseline controls recommended by the Canadian Centre for Cyber Security for small and medium organizations.
FAQ
Is my company too small to be a target
No. Attackers scan the Internet without sorting by company size: they look for a poorly secured system, not a known brand. An SME with a handful of employees handles personal information, banking access, and customer records that have value. The Canadian Centre for Cyber Security publishes baseline controls specifically designed for small organizations. The right question is not your size, but what is reachable from outside.
How do we know if one of our tools is accessible from the Internet
Put the question in writing to your IT provider and request a list naming every service published to the Internet, along with its purpose. Check that it includes remote access tools, file servers, cameras, and test environments, which are often overlooked. Also ask who can connect to them. A list that no one is able to produce is itself a useful result.
Do we need to report a personal information breach in Quebec
The Act respecting the protection of personal information in the private sector requires a Quebec company to maintain a register of confidentiality incidents. When an incident presents a risk that serious harm could be caused, the company must notify the Commission d’accès à l’information (Quebec’s access-to-information oversight body) as well as the affected individuals. Prepare this register before you need it: decide who maintains it, where it is kept, and who makes the decision to notify.
Sources
- The Record (Recorded Future News) · press, November 6, 2026
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · reference checklist
- Commission d’accès à l’information du Québec · obligations, incident register, and notification
Source: The Record (Recorded Future News) · https://therecord.media/digicert-certificate-authority-reports-data-breach
Article prepared by RISS Canada’s monitoring team based on the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial standards.
