Actalis: Issuance of certificate using keys previously reported as compromised

Actalis reported an incident involving the issuance of 18 certificates using private keys that had previously been revoked due to compromise. The issue was identified following a third-party report on January 23, 2026, leading to an internal investigation. All affected certificates were revoked by February 6, 2026. The root cause was a misconfiguration in the control mechanism that failed to prevent issuance against known compromised keys. Actalis has since implemented corrective actions and committed to strengthening its change management processes to prevent future occurrences.

1. 2026-01-23 Incident reported by third party
2. 2026-01-28 Update on analysis and identification of additional affected certificates
3. 2026-02-06 All affected certificates revoked
4. 2026-02-27 Incident report closure summary issued