DigiCert Confirms Data Breach Exposing Customer Details and Sensitive Identity Documents

DigiCert has confirmed a data breach involving an internal business system that stored customer contact details and identity documents. Unauthorized access exposed archived information, including names, business email addresses, phone numbers, and business addresses.

A small minority of affected customer accounts also contained passports, driver’s licenses, utility bills, or other documents showing names and addresses.

The company said the incident affected only a small proportion of its archived data. Its public report does not provide a total number of affected people, organizations, or documents. DigiCert confirmed the unauthorized data access on October 19, 2026, and filed its preliminary incident report the following day.

DigiCert said its Certificate Authority services, CertCentral, and DigiCert ONE were unaffected. The company said customer login credentials and issued certificates remain secure.

Investigators found no certificate issuance, validation changes, or revocation activity linked to the unauthorized account. Customers do not need to replace active certificates because of this incident.

Troy Hunt shared DigiCert’s notification on X, asking, “Anyone else get one of these from @digicert?” The email said the company was reviewing identity documents to identify affected individuals and would notify them once the review was complete.

DigiCert Confirms Data Breach

The exposure began with an infrastructure migration on February 4, 2025. DigiCert moved the business system from a network segment restricted by a virtual private network, or VPN, to another availability zone. That change accidentally made the internal system accessible from the internet without a security review of its new exposure.

An account registration feature, intended for other uses of the account management platform, also became available. Accounts created through that feature were not covered by the multifactor authentication required for DigiCert staff. Although these accounts had no application assigned, they received read-only access to archived information, revealing a gap in permission checks.

According to DigiCert’s incident report, staff noticed non-DigiCert accounts on June 18, 2026. An initial review incorrectly concluded that accounts without an assigned application could not access data. A web application firewall blocked new registrations through the external access path, but existing access remained a concern.

A report from DigiCert’s managed security research program followed on June 21. Engineers confirmed the registration issue and released an authorization fix on July 2. Investigators later established that unauthorized data access occurred between June 27 and July 2. DigiCert initially treated the problem as an account-creation issue rather than a data-access incident.

The company first suspected access to archived information on October 12. Retained logs and audit records helped investigators reconstruct the access window and link activity to the account. The account could read records but could not change them, approve identity checks, or issue certificates.

DigiCert subsequently disabled self-registration, moved remaining exposed endpoints behind private network infrastructure, reset business system passwords, and strengthened monitoring. It also completed a permissions review and required security approval for network access changes. The report’s action items include further checks on external exposure and account alerts.

This disclosure concerns archived customer information, not compromised certificate operations. It differs from the earlier DigiCert support-system breach involving code-signing certificates and the 2024 DNS validation error that required certificate replacements.

Here, the central failure was allowing newly registered accounts to read sensitive records. DigiCert’s stated lesson is direct: internal tools need explicit authorization checks, even when network restrictions are expected to protect them.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post DigiCert Confirms Data Breach Exposing Customer Details and Sensitive Identity Documents appeared first on Cyber Security News.