DigiCert data breach exposed customer IDs and contact info

DigiCert says an internal business system was accidentally exposed to the internet during a server migration, and an unauthorized read-only account accessed archived customer records and, in some cases, identity documents. Reports from BleepingComputer and SecurityWeek say the exposure came after a February 2025 migration, with the unauthorized access occurring between June 27 and July 2, 2026, and further investigation confirming the data access in October.

What happened, in plain terms

According to reporting by BleepingComputer and SecurityWeek, DigiCert moved an internal business system to a different network segment in February 2025 and that system became reachable from the public internet. The system included an account manager with a self-registration feature intended for use by other internal applications. That feature allowed external users to create accounts, and an authorization flaw let a created account read archived customer data.

DigiCert first noticed unauthorized accounts on the system in June 2026 and disabled the offending account on July 2, 2026. The company initially treated the matter as an account-creation issue, and only later determined that archived data had been read. BleepingComputer reports that DigiCert confirmed the unauthorized account had accessed customer information during the June 27 to July 2 window after an October 19 review. SecurityWeek reports a similar timeline and notes that DigiCert added monitoring, verified or removed non-DigiCert accounts, reset passwords for business system users, and disabled self-registration after mid-October.

What data was exposed

Both outlets say the exposed archive included business contact details, specifically names, business email addresses, phone numbers, and business addresses. In some records, additional documentation that customers had provided for identity checks was accessible. Reported examples of those documents include driver’s licenses, passports, utility bills, and similar documents that show name and address.

BleepingComputer and SecurityWeek both report that the unauthorized account had read-only access and could not change records, act as a validation approver, or issue certificates. DigiCert has said its certificate authority platforms, including CertCentral and DigiCert ONE, were not impacted and that issued certificates and customer login credentials remain secure, according to the reporting.

Why this matters to your organization

If your business, nonprofit, or public sector team has used DigiCert and submitted identity documents as part of a certificate or account process, some of that archived data may be among the exposed records. Contact and identity data can be used to craft convincing phishing or impersonation attempts aimed at your staff, partners, or customers. Even if issued certificates and CA systems were not altered, attackers who hold contact details or identity documents can try social engineering, targeted phishing, or business email compromise.

The incident also shows how a non-CA internal system, intended for business processes, can become an exposure point when its network placement or self-service features change. Treat third-party archival or business systems as part of your supply chain risk picture.

Practical steps you should take now

• Check whether your organization received a notification from DigiCert; the company says it has begun sending breach notices to affected customers, per BleepingComputer and SecurityWeek. If you got a notice, follow the instructions in it.
• Assume exposed contact or ID data could be used in phishing. Remind staff to be skeptical of unexpected requests for money, credentials, or privileged actions, and verify requests by phone or another known channel.
• Review any identity documents you submitted to DigiCert or similar vendors and assess whether you need to reissue or replace IDs with issuing authorities, if advised by those authorities.
• Confirm that multi-factor authentication is enabled for critical accounts and admin access, and review who has privileged access to certificate management and other sensitive systems.
• Check logs and alerting for unusual access to your email, business systems, or certificate management portals, and consider resetting passwords where there is any doubt, following your normal change controls.
• If you use DigiCert or other CAs as part of your operations, ask them what data they retain in archives and how long, and whether archived records are subject to the same access controls as active systems.

What DigiCert says and what remains unclear

DigiCert has acknowledged the exposure and, according to reporting, notified affected customers. The company says the unauthorized account could only read archived records and could not alter records or issue certificates, and that CA platforms were not compromised. BleepingComputer cites a DigiCert incident report on Mozilla's Bugzilla that explains the migration and exposure. SecurityWeek reports the company implemented additional monitoring, removed non-DigiCert accounts, reset business system passwords, and disabled self-registration since mid-October.

What the public reporting does not include is a confirmed count of how many customers were affected. Both outlets say they have requested further details from DigiCert and may update their stories if the company provides more information.

Questions to ask your vendor or CA

• Did you receive a notification from DigiCert about this incident, and does it apply to our account?
• What documents did we supply to DigiCert, and are those documents part of the exposed archive?
• What controls has DigiCert added to prevent similar exposures, and can they provide evidence of those controls?

If you want a quick external look at how exposed your own site and public services are, start with a free external scan from our security page: /security.html

For now, treat contact and identity data exposures as a prompt to tighten verification workflows and to increase phishing awareness across your team. Keep an eye on official communications from DigiCert and the coverage from BleepingComputer and SecurityWeek for updates.