DigiCert data breach exposes customer information and identity documents - Beinsure

DigiCert has disclosed a data breach that exposed archived customer information and, in some cases, personal identification documents after a server migration inadvertently made an internal business system accessible from the internet.

The certificate authority confirmed that an unauthorized account accessed customer records between June 27 and July 2, 2026. The affected information included names, business email addresses, telephone numbers and business addresses.

The incident originated from a server migration in February 2025, when DigiCert moved an internal business system to a different network segment. The system, previously accessible only through a virtual private network (VPN), became exposed to the public internet.

According to DigiCert’s incident report on Mozilla’s Bugzilla platform, the affected system contained a self-registration function intended to support other applications. External users could create accounts through this feature without multifactor authentication (MFA).

Although newly created accounts were not assigned to specific applications, an authorization flaw allowed them to access archived customer information. The access was read-only, preventing unauthorized users from modifying stored records.

DigiCert initially identified unauthorized accounts on the exposed system in June 2026. At the time, the company concluded that the accounts could not access customer information because they were not assigned to an application.

A subsequent report submitted through DigiCert’s managed security research program warned that external users could create accounts on the system. DigiCert implemented security changes to restrict access and address the authorization flaw.

The company blocked the unauthorized account on July 2, but did not initially establish that customer records had been accessed. On October 12, DigiCert began investigating whether the account had accessed archived customer information.

A further investigation confirmed on October 19 that the account had accessed customer records between June 27 and July 2. The findings established that the security flaw had enabled unauthorized access to archived information before the account was blocked.

DigiCert confirmed that the compromised information included business contact details and, for some customers, identity verification documents. Potentially exposed documents included passports, driver’s licenses, utility bills and other records containing names and addresses.

In its breach notification, the company said the affected records were limited to names, business email addresses, telephone numbers, business addresses and identification documents where customers had provided them.

DigiCert said it was continuing to examine the identification documents involved and would notify additional affected individuals as the review progressed. The company has not publicly confirmed the total number of customers or individuals affected.

DigiCert emphasized that the incident did not affect its certificate issuance infrastructure or customer-facing certificate management platforms. The company said its certificate authority systems, CertCentral and DigiCert ONE remained secure.

Customer login credentials and previously issued certificates were also unaffected, according to DigiCert. The company confirmed that the access could not write records, act as a validation approver, or issue certificates.

DigiCert also confirmed that its certificate authority systems operate on separate, secured network segments. The incident therefore involved unauthorized access to archived business information rather than a compromise of certificate issuance or validation operations.

Following the investigation, DigiCert introduced additional security measures to prevent similar unauthorized access. The company restricted access to the affected business system and disabled the self-registration feature that had allowed external account creation.

It also implemented additional monitoring and alerting, reviewed remaining accounts not belonging to DigiCert and either verified or removed them. Passwords for business system users were reset, while the company reviewed system ownership and the enforcement of access permissions.

The remediation measures included correcting the authorization weakness that had permitted unassigned accounts to view archived records. DigiCert continues to assess the customer information involved and notify affected individuals.

BleepingComputer has requested further details from the company, including the number of people affected. DigiCert had not provided that figure in the reporting available at the time.