DigiCert breach exposed archived customer data and ID documents

DigiCert has begun notifying customers that a server migration in February 2025 left an internal business system exposed to the internet, where an unauthorized account read archived customer records — including, for some people, identity documents — in late June 2026. The company says its certificate authority services, CertCentral and DigiCert ONE were not touched, and no certificates were issued or modified.

What happened

Per DigiCert's incident report — filed to Mozilla's Bugzilla, the standard venue for CA incident disclosures, and reported by BleepingComputer — the February 2025 migration moved an internal system that had previously been reachable only over VPN onto the public internet. The system carried a self-registration feature meant for other applications, which let external users create accounts. An authorization flaw then let those unassigned accounts read archived customer data in read-only mode.

Timeline

• February 2025: the migration exposes the system.
• June 2026: DigiCert finds unauthorized accounts but concludes they can't reach customer data. A report through its managed security research program flags the self-registration path; fixes are deployed, but DigiCert doesn't realize archived data was read.
• 27 June – 2 July 2026: an unauthorized account accesses archived customer information (confirmed only later).
• 19 October 2026: investigation confirms the access.
• 5 November 2026: public disclosure and customer notifications begin.

What was exposed

Names, business email addresses, phone numbers and business addresses. Some records also held identity documents — driver's licenses, passports or utility bills — where customers had previously supplied them. DigiCert calls it a "small portion" of its archived customer data and had not published a count at publication.

DigiCert's own report concedes the misread: the incident "was initially handled as an account-creation issue rather than a data-access event."

What's not affected

DigiCert says CertCentral, DigiCert ONE and its CA services were not compromised, login credentials and issued certificates remain secure, and the unauthorized account was read-only — it could not modify records, approve validations, or issue certificates. This is a data-exposure incident, not a certificate-trust incident.

Action checklist

1. If you receive a DigiCert breach notice, treat the exposed business contact details as public and watch for targeted phishing referencing your DigiCert account or pending orders.
2. If you ever uploaded identity documents (passport, driver's license, utility bill) to DigiCert, review them as potentially exposed and monitor for identity-fraud use.
3. No action is required on active certificates — DigiCert says issuance and CertCentral were unaffected. Don't mass-reissue out of caution; there's no trust impact.
4. Rotate DigiCert portal credentials as routine hygiene if you haven't recently, though DigiCert reports credentials were not in the exposed store.

Context

Breaches at public CAs draw scrutiny because of the trust they anchor, but the damage here is self-registration plus a stale network boundary — an exposed internal app, not the PKI. The instructive detail is how long it hid: a read-only authorization gap sat unnoticed from a 2025 migration until mid-2026 because the first investigation scoped it as an account-creation nuisance rather than a data-access event. Migrations that move a VPN-only system onto the public internet deserve an access-control review, not just a connectivity test.