DigiCert Confirms Data Breach Exposing Customer Details and Sensitive Identity Documents

DigiCert has confirmed a data breach involving an internal business system that stored customer contact details and identity documents. Unauthorized access exposed archived information, including names, business email addresses, phone numbers, and business addresses. A small minority of affected customer accounts also contained passports, driver’s licenses, utility bills, or other documents showing names and addresses. The company stated that the incident affected only a small proportion of its archived data, but did not provide a total number of affected individuals, organizations, or documents.

The exposure began with an infrastructure migration on February 4, 2025. DigiCert moved the business system from a network segment restricted by a virtual private network (VPN) to another availability zone. This change inadvertently made the internal system accessible from the internet without a proper security review of its new exposure. Additionally, an account registration feature, intended for other uses of the account management platform, became available.

Accounts created through this feature were not covered by the multifactor authentication required for DigiCert staff. Although these accounts had no application assigned, they gained read-only access to archived information, revealing a significant gap in permission checks. Investigators found that non-DigiCert accounts were noticed on June 18, 2026, but an initial review incorrectly concluded that accounts without an assigned application could not access data.

A web application firewall did block new registrations through the external access path, but existing access remained a concern. Following a report from DigiCert’s managed security research program on June 21, engineers confirmed the registration issue and released an authorization fix on July 2. Investigators later established that unauthorized data access occurred between June 27 and July 2, 2026.

DigiCert confirmed the unauthorized data access on October 19, 2026, and filed its preliminary incident report the following day. The company emphasized that its core Certificate Authority services, CertCentral, and DigiCert ONE were unaffected, and customer login credentials and issued certificates remain secure. Investigators found no certificate issuance, validation changes, or revocation activity linked to the unauthorized account, meaning customers do not need to replace active certificates.

Following the discovery, DigiCert disabled self-registration, moved remaining exposed endpoints behind private network infrastructure, reset business system passwords, and strengthened monitoring. The company also completed a permissions review and mandated security approval for network access changes. The incident report includes action items for further checks on external exposure and account alerts.

This disclosure concerns archived customer information and differs from previous incidents, such as the DigiCert support-system breach involving code-signing certificates or the 2024 DNS validation error. The central failure in this case was allowing newly registered accounts to access sensitive records without adequate authorization. DigiCert's stated lesson is that internal tools require explicit authorization checks, even when network restrictions are expected to provide protection.