Overview
DigiCert, one of the largest public certificate authorities, has begun notifying customers of a data breach. The company says a server migration mistake exposed an internal business system to the internet, allowing an unauthorized account to read archived customer information, including some identity documents.
What Happened
The exposure traces back to a server migration in February 2025, which left an internal business system, previously reachable only over VPN, accessible from the internet. The system had a self-registration feature intended for other applications, which let outside users create accounts. Those accounts were not assigned to any application, but an authorization flaw still let them read archived customer data.
Timeline
| Date | Event |
|---|---|
| February 2025 | Migration exposes the internal system |
| June 2026 | DigiCert finds unauthorized accounts and concludes they could not reach customer data |
| After a researcher report | A report via DigiCert's managed security research program warns external users can create accounts; fixes are deployed, but access to archived data is not recognized |
| June 27 to July 2, 2026 | An unauthorized account accesses customer information |
| October 19, 2026 | Further investigation confirms the access |
| Early November 2026 | Breach notifications begin |
DigiCert acknowledged that the incident was initially handled as an account-creation issue rather than a data-access event.
Data Exposed
- All affected customers: names, business email addresses, phone numbers and business addresses.
- Some customers: identity documents such as driver's licenses, passports or utility bills, where they had been provided for validation.
DigiCert has not said how many people are affected and is still reviewing identity documents to determine scope.
What Was Not Affected
DigiCert says the account had read-only access and could not modify records, approve certificate validations or issue certificates. It states that its CA services, CertCentral and DigiCert ONE were not compromised, and that customer login credentials and issued certificates remain secure.
Response
DigiCert restricted access to the affected system, disabled self-registration and added access controls.
Recommendations
- Expect targeted phishing. Contact details plus a known DigiCert relationship make convincing lures. Verify any follow-up request through known DigiCert contact channels.
- Read your notification carefully if you submitted identity documents, and follow its guidance. Consider credit monitoring if government ID was involved.
- Audit your own migrations. Treat any move of an internal system as a change that needs an exposure check: confirm VPN-only services are still unreachable from the internet and that self-service features are disabled where unneeded.
- Treat researcher reports as potential data-access events, not just configuration bugs, and check logs for actual access before closing them.