DigiCert Confirms Data Breach Exposing Customer Details and Sensitive Identity Documents - CyberSecurityNews

The company confirmed the unauthorized data access on October 19, 2026, and filed its preliminary incident report the following day. While the breach affected archived customer information including names, business email addresses, phone numbers, and business addresses, a small minority of affected accounts also contained passports, driver's licenses, utility bills, or other documents showing names and addresses.

DigiCert emphasized that its core services remained unaffected. The company stated that its Certificate Authority services, CertCentral, and DigiCert ONE were not compromised, and customer login credentials and issued certificates remain secure. Investigators found no evidence of certificate issuance, validation changes, or revocation activity linked to the unauthorized account.

Root Cause

The exposure began with an infrastructure migration on February 4, 2025, when DigiCert moved a business system from a VPN-restricted network segment to another availability zone. This change accidentally made the internal system accessible from the internet without a security review of its new exposure.

An account registration feature intended for other uses of the account management platform became available externally. These accounts were not covered by the multifactor authentication required for DigiCert staff and received read-only access to archived information, revealing a gap in permission checks.

Timeline of Discovery

Staff noticed non-DigiCert accounts on the system on June 18, 2026. An initial review incorrectly concluded that accounts without an assigned application could not access data. A web application firewall blocked new registrations, but existing access remained a concern.

Engineers confirmed the registration issue on June 21 and released an authorization fix on July 2. Investigators later established that unauthorized data access occurred between June 27 and July 2. DigiCert initially treated the problem as an account-creation issue rather than a data-access incident.

The company first suspected access to archived information on October 12. Retained logs and audit records helped investigators reconstruct the access window and link activity to the account. The compromised account could read records but could not change them, approve identity checks, or issue certificates.

Aftermath and Response

Following the discovery, DigiCert disabled self-registration, moved remaining exposed endpoints behind private network infrastructure, reset business system passwords, and strengthened monitoring. The company also completed a permissions review and required security approval for network access changes.

DigiCert stated that internal tools need explicit authorization checks, even when network restrictions are expected to protect them. The company is reviewing identity documents to identify affected individuals and will notify them once the review is complete. This breach differs from previous DigiCert incidents involving code-signing certificates and DNS validation errors.