DigiCert discloses breach of archived customer data and identity documents, says no certificates were affected

TLDR

• An unauthorised account read DigiCert's archived customer contact details and some identity documents from 27 June to 2 July 2026.²
• DigiCert says logs show no certificate issuance, validation or revocation activity linked to the account.²
• A February 2025 migration left the system internet-reachable; DigiCert confirmed data access only on 19 October 2026.²

BleepingComputer reports that DigiCert, a certificate authority, warned it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet.¹ The affected records are a small portion of its archived customer data: names, business email addresses, phone numbers and business addresses, and for some people an identification document such as a driver's licence, passport or utility bill.¹ DigiCert's incident report, filed with Mozilla's CA compliance process, describes the system as one that archives information customer representatives provide to validate their identity, and says a small minority of customer accounts included such a document.² DigiCert has begun sending notifications and says it is still reviewing identification documents to work out who was affected; BleepingComputer cites a copy shared on X by Fabian Bader, and Cyber Security News cites one shared by Troy Hunt.¹³ Cyber Security News and Cyber Daily both report that DigiCert has not given a total number of people or customers affected.³⁴

According to the incident report, the system was moved on 4 February 2025 from a VPN-restricted network segment to a different availability zone, which made it reachable from outside.² Its account manager included a registration feature intended for other uses, so accounts created through that endpoint were not subject to the multi-factor authentication DigiCert otherwise requires and were read-only by default, yet still had access to archived data.² DigiCert's team saw non-DigiCert accounts on 18 June 2026 and concluded that accounts with no assigned application had no data access; it put the system behind a web application firewall to block new registrations.² A report from its managed security research programme arrived on 21 June, an authorisation fix went to production on 2 July, and the investigation later placed the data access between 27 June and 2 July.² DigiCert first suspected access to the archived data on 12 October and confirmed a reportable event on 19 October.² The report says the incident was initially handled as an account-creation issue rather than a data-access event.²

On certificate issuance, DigiCert's report states that its certificate authority services, CertCentral and DigiCert ONE were unaffected, that customer login credentials and issued certificates remain secure, valid and trusted, and that no action is needed from customers regarding active certificates.² It says the access could not write records, act as a validation approver or issue certificates, and lists zero certificates affected.² It also says issuance was not stopped because CA systems run on their own network segments, and that a logs review of CA and validation activity found no validation actions, certificate issuance or revocation activity associated with the account.² BleepingComputer, Cyber Security News and Cyber Daily report the same assurances.¹³⁴

None of the sources identifies who created the account. Cyber Daily describes unidentified attackers who bypassed multi-factor authentication to gain read-only access, whereas DigiCert's report says accounts made through the registration endpoint were simply not covered by it.²⁴ Fixes listed in the report include deactivating self-registration and moving the remaining exposed endpoints behind private-IP load balancers on 24 October, resetting passwords for all business system users, a least-privilege permissions review completed on 30 October, and new alerts on file access and request volumes.² An internal audit that no business system origin server is externally accessible was listed as ongoing, due 6 November.² The report also lists two recent related incidents dealing with archive data, one at TWCA (unauthorised access to an RA server) and one at D-Trust (loss of archived RA records).²

Why it matters: the exposed records are identity documents that customers gave a certificate authority for validation, and the access went unconfirmed for months after DigiCert first saw unknown accounts on its system.²