THE CRUNCH
DigiCert has disclosed a data breach in which an unauthorised account accessed archived customer contact information, and in some cases identity documents such as passports, driver's licences and utility bills. The affected data includes names, business email addresses, phone numbers and business addresses. The company says certificate authority systems, CertCentral and DigiCert ONE were unaffected, and that the intruder could not issue, revoke or validate certificates.
The root of the problem was a February 2025 server migration that moved an internal archiving system off a VPN-protected network and inadvertently exposed it to the public internet, where it sat for more than 16 months. The archive shared an account management platform with DigiCert's customer-facing products, including a self-registration feature that was never meant to be available internally, letting outsiders create accounts without multifactor authentication and, through a separate permissions flaw, browse archived records.
According to DigiCert's incident report, the company spotted the unauthorised accounts on 18 June 2026 but initially dismissed them as harmless. A security researcher raised the alarm three days later, and the account was blocked on 2 July, by which point it had read archived data between 27 June and 2 July. Only on 12 October did DigiCert begin investigating whether customer information had actually been accessed, confirming on 19 October that a subset of records had been viewed.
DigiCert has since disabled self-registration, reset passwords for business system users, tightened network access and added monitoring. It has begun notifying affected customers but has not said how many people or organisations are involved, describing the affected records as a "small proportion" of its archive. A review of identification documents is under way to identify specific individuals, who will be notified once it completes.
A company spokesperson told Recorded Future News that, to its knowledge, there is no evidence of misuse of the accessed information, and that DigiCert has reported the incident to law enforcement. The breach was reportable under the incident rules set by Mozilla, Google Chrome, Microsoft and Apple for certificate authorities.