PKIoverheid delayed preliminary incident report beyond the required 72-hour timeframe

PKIoverheid reported that it failed to publish a preliminary incident report within the required 72-hour timeframe after becoming aware of an incident related to missed Audit Attestation Letter publication in CCADB. The bug states that the team focused on fixing the Audit Attestation Letter issue and did not adequately manage the separate incident-reporting obligation in parallel. The report explicitly says this case is about the delayed preliminary incident report, separate from the underlying Audit Attestation Letter non-compliance tracked in Bug 2074032. The filing cites the CCADB Incident Reporting Guidelines and Mozilla Root Store Policy incident disclosure requirements. The thread indicates that a full incident report will document the root cause, timeline, and corrective and preventive actions.

1. 2026-10-20 PKIoverheid became aware of an incident after missing the deadline for publishing Audit Attestation Letters in CCADB.
2. 2026-10-20 PKIoverheid published a preliminary incident report after the required 72-hour reporting window had already passed.

1. 2026-10-20 Logius representative — Opened the bug and stated that PKIoverheid missed the 72-hour deadline for a preliminary incident report, citing Bug 2074032 as the underlying issue and noting that a full incident report will follow.