DigiCert data breach exposes customer information, identity documents

DigiCert, a certificate authority, says a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. BleepingComputer's report, by Lawrence Abrams and published November 5, 2026, at 11:12 AM, says a small portion of archived customer data was affected. Those records include names, business email addresses, phone numbers, and business addresses, plus driver's licenses, passports, and utility bills for some people.

This piece is for DigiCert customers who shared business contact details or verification documents, and for teams that use CertCentral or DigiCert ONE. It covers the February 2025 migration, the self-registration feature and authorization flaw that opened archived files in read-only mode, and the June 27 to July 2, 2026 window when one unauthorized account read customer information.

What broke in DigiCert data breach exposes customer

A February 2025 server migration mistakenly exposed an internal business system to the internet. Before that migration, the system was reachable only through a VPN. An incident report on Mozilla's Bugzilla platform says the system contained a self-registration feature intended for other applications, and that feature let external users create accounts. The new accounts were not assigned to any particular application. An authorization flaw still let them reach archived customer information in read-only mode. DigiCert says that archive was a small portion of its archived customer data.

DigiCert first discovered unauthorized accounts on the exposed system in June 2026. It initially determined those accounts could not access customer information because they were not assigned to an application. A report through DigiCert's managed security research program then warned that external users could create accounts on the system. DigiCert deployed security fixes to restrict access and address the authorization flaw, but it did not realize at the time that archived data had been accessed. The company acknowledged, "The incident was initially handled as an account-creation issue rather than a data-access event."

Who is exposed by DigiCert data breach exposes customer

DigiCert says the breach affected a small portion of archived customer data. Its data breach notification reads, "The information involved was limited to names, business email addresses, phone numbers, and business address shared with DigiCert and, if provided, may have included an identification document such as a driver’s license, passport, utility bill or other document with name and address." The same notice is what DigiCert has begun sending to affected customers. The company described the exposed material as customer information held in that archive.

For some people, the records also contained personal identification documents, such as driver's licenses, passports, and utility bills kept in that archive. Cloud architect Fabian Bader shared a copy of his notification on X. "Thanks @digicert that your data leak was 'limited' to only my full PII data and potentially any verification documents I submitted for my certificate," Bader wrote. DigiCert said it was still reviewing identification documents to determine who was affected and would notify those people once the review was complete.

What to do now about DigiCert data breach exposes customer

DigiCert has begun sending data breach notifications to affected customers. The notice limits the information to names, business email addresses, phone numbers, and business address, and says an identification document may have been included if the customer provided one. DigiCert is still reviewing identification documents, such as a driver's license, passport, utility bill, or other document with a name and address, to determine which customers were affected. The company said it will notify those people once that review is complete.

DigiCert has restricted access to the affected system, disabled self-registration, and added additional access controls. The unauthorized account had read-only access and could not modify records, approve certificate validations, or issue certificates. DigiCert says its certificate authority services, CertCentral, and DigiCert ONE platforms were not compromised, and that customer login credentials and issued certificates remain secure. BleepingComputer has contacted DigiCert to ask further questions about the incident, including how many people were impacted, and had no response as of November 5, 2026.

How the DigiCert data breach exposes customer issue works

The system involved was an internal business system. The February 2025 migration placed it on the internet after it had been accessible only via VPN. A self-registration feature intended for other applications let external users create accounts, and those accounts were not assigned to any particular application. An authorization flaw then allowed the accounts to open archived customer information in read-only mode. That access could not modify records, approve certificate validations, or issue certificates. DigiCert later tied confirmed reads of the archive to a single unauthorized account.

In June 2026 DigiCert found the unauthorized accounts and handled the incident as an account-creation issue rather than a data-access event. DigiCert determined the accounts could not reach customer information because they were not assigned to an application. On October 19, a further investigation confirmed an unauthorized account had accessed customer information between June 27 and July 2, 2026. Fixes that restricted access and addressed the authorization flaw were already deployed before DigiCert realized the archive had been read. Self-registration stays disabled.

What is still unknown about DigiCert data breach exposes customer

DigiCert has not said how many people fall inside the small portion of archived customer data. BleepingComputer contacted the company with further questions, including how many people were impacted, and had no response as of November 5, 2026. The review of identification documents is still open. DigiCert said it will notify people once that review shows they were affected, covering a driver's license, passport, utility bill, or other document with a name and address where one was provided. The unauthorized account has not been identified.

The October 19 investigation confirmed that one unauthorized account accessed customer information between June 27 and July 2, 2026. DigiCert has not said which archived records that account opened, or how many held a driver's license, passport, or utility bill. For some people those documents were in the exposed records. The notification says an identification document may have been included if the customer provided it. DigiCert says its certificate authority services, CertCentral, and DigiCert ONE platforms were not compromised, and issued certificates remain secure.