Overview
Certificate authority DigiCert has reported a data breach involving business customer information. Over the summer, an internal business system was externally accessible when that was not intended, and someone created an unauthorized account. DigiCert published a post-mortem on Mozilla's Bugzilla, and the incident was reported on November 6, 2026.
Timeline
| Date | Event |
|---|---|
| February 2025 | The system is moved out of a VPN-restricted network, making it externally accessible |
| June 21, 2026 | DigiCert determines the system was externally accessible and an unassigned account had been created |
| June 27, 2026 | Database first accessed, per DigiCert's later confirmation |
| By July 2, 2026 | Issue fixed |
| October 19, 2026 | DigiCert confirms the incident is a reportable event |
Exposed Data
- Customer names
- Business email addresses and phone numbers
- Documents such as driver's licenses, passports and utility bills
- Other information
DigiCert has not said how many customers were affected.
DigiCert's Response
A spokesperson said, "To our knowledge, there is no evidence of misuse of the information involved." The company says attackers could not issue certificates, certificate authority services were not affected, and customer login credentials were not taken. It has reported the incident to law enforcement and declined to say whether the attackers contacted it.
DigiCert attributed the delayed detection to the migration being treated as an infrastructure change rather than a security change, and to insufficient alerting on new account creation and request volume. The incident was reportable under Mozilla, Google Chrome, Microsoft and Apple requirements.
Why It Matters
Identity documents held for validation are valuable for fraud and social engineering, and attackers could use them to impersonate organizations. The exposure lasted for months before detection.
Recommendations
- Watch for phishing that references your DigiCert account or certificate orders.
- Review certificate validation contacts and watch for unexpected change requests.
- Treat network moves as security changes: require security review when systems leave restricted segments.
- Alert on new account creation and unusual request volume on internal business systems.