Science & Tech · Cybersecurity · 48 mins ago
DigiCert breach exposed customer details and some identity documents
DigiCert says unauthorized users accessed archived customer data after a server migration exposed an internal system to the internet.
The certificate authority says the system was left accessible after a February 2025 migration and allowed external users to create accounts.
An authorization flaw gave an unauthorized account read-only access from June 27 to July 2, 2026.
The exposed records included names, business email addresses, phone numbers and business addresses; some also contained passports, driver’s licenses or utility bills.
DigiCert initially treated the issue as account creation, but a deeper investigation confirmed in October that customer data had been accessed.
Its certificate services and issued certificates remain secure, the company says.
DigiCert has disabled self-registration, added access controls and is notifying customers while reviewing which identity documents were exposed.
A DigiCert data breach exposed archived customer information and, in some cases, identity documents.
A server migration in February 2025 left an internal system accessible from the internet.
An authorization flaw allowed unauthorized accounts to access customer data in read-only mode between June 27 and July 2, 2026.
DigiCert confirmed the data access on October 19 after an investigation.
The company says its certificate services, CertCentral and DigiCert ONE were not compromised.
DigiCert has disabled self-registration, added access controls and begun notifying affected customers.
- Who
- DigiCert and customers whose archived information was accessed.
- What
- Unauthorized accounts accessed archived customer data, including identity documents in some cases.
- When
- The access occurred between June 27 and July 2, 2026; DigiCert confirmed it on October 19.
- Where
- An internal DigiCert business system exposed to the internet.
- Why
- A February 2025 server migration exposed the system, and an authorization flaw allowed accounts to access archived data.
This story does not have two clearly opposing sides.
A server migration mistakenly exposed an internal business system to the internet.
DigiCert discovered unauthorized accounts on the exposed system.
An unauthorized account accessed archived customer information in read-only mode.
A further investigation confirmed that customer information had been accessed.
- Exposed data
- Names, business email addresses, phone numbers and business addresses
- Identity documents
- Passports, driver’s licenses and utility bills in some cases
- Access window
- June 27–July 2, 2026
- Investigation confirmation
- October 19
- Unaffected services
- CertCentral and DigiCert ONE
3 sources
What people are saying
Thanks @digicert that your data leak was 'limited' to only my full PII data and potentially any verification documents I submitted for my certificate
The incident was initially handled as an account-creation issue rather than a data-access event
Posts on X
Thanks @digicert that your data leak was "limited" to only my full PII data and potentially any verification documents I submitted for my certificate. 🚨