DigiNotar let a hacker issue 531 fake certificates — bankrupt within ten weeks

DigiNotar was one of the root certificate authorities trusted by every major browser and the issuer of certificates for Dutch government services. In June 2011 an intruder walked into its network through unpatched software on its web servers and moved laterally across the segmented systems that were supposed to isolate certificate issuance. On 10 July the intruder issued a fraudulent certificate for google.com. DigiNotar's routine audit found rogue certificates on 19 July, revoked them, investigated, and by the end of the month believed the problem was closed. It had not found them all.

On 27 August a Gmail user in Iran found Google's own browser, Chrome, refusing the connection — Google 'pinned' the certificates it had really bought, so a DigiNotar-issued google.com certificate stood out instantly. Google went public on 29 August, warning of man-in-the-middle attacks against users in Iran. Investigators later counted 531 rogue certificates for domains including aol.com, microsoft.com, cia.gov and mossad.gov.il, and about 298,000 unique IP addresses — 95 percent of them in Iran — hitting fake Google pages that could harvest Gmail passwords.

The collapse was fast and total. Browser makers stripped DigiNotar from their trust stores; on 14 September the Dutch regulator OPTA terminated its registration as a certificate issuer; and the Haarlem District Court declared it bankrupt on 20 September 2011 — ten weeks after the first rogue certificate was issued, three weeks after the breach became public. Owner Vasco Data Security reported a $6.1 million discontinued-operations loss plus $5.2 million of impairments in its 2011 10-K, and shut the certificate business for good.

DigiNotar B.V. bankrupt on 20 September 2011; owner Vasco booked a $6.1M discontinued-operations loss and $5.2M of impairments, and exited the CA business

Unpatched software on internet-facing web servers gave the intruder his entry point into an otherwise heavily defended network.

The July internal audit declared the incident closed without proving no other rogue certificates existed — the fatal google.com one surfaced only when a user's browser refused it.

A certificate authority's only asset is trust. Once Chrome, Firefox and Microsoft stopped honouring its certificates, there was no revenue left to protect.

DigiNotar treated a public-safety incident as a private IT problem to contain quietly; a CA breach implicates everyone the certificates vouch for.

When your product is trust, any breach is existential, and 'we fixed it' declared after an internal audit is not the same as the breach being over — one missed fake certificate can end the company.

No one has ever been caught or charged; press reporting has speculated, without proof, about Iranian state involvement. The Dutch government took over DigiNotar's operations and commissioned the Fox-IT 'Black Tulip' post-mortem. The incident pushed the industry toward Google's Certificate Transparency, wider certificate pinning, and stricter CA baseline requirements — changes whose authors cite DigiNotar by name. Vasco, later rebranded OneSpan, never re-entered the certificate business, and the FTC's non-public investigation closed without allegations.