DigiCert data breach exposes customer information and identity documents

DigiCert, a major global certificate authority, has disclosed a security breach resulting from a server migration error. An internal business system, previously protected by VPN access, was mistakenly exposed to the internet, leading to unauthorized access to customer archives.

• The breach originated from a server migration process in February 2025.
• Exposed data includes customer names, business emails, phone numbers, and addresses.
• Some users had identity documents like passports or utility bills exposed.
• DigiCert confirmed that CertCentral and its core CA services were not compromised.

Incident Background

According to incident reports filed on Mozilla’s Bugzilla, the issue stemmed from a self-registration feature within an internal system that was inadvertently made public. An authorization flaw allowed unauthorized external accounts to be created, granting read-only access to archived customer data.

While DigiCert first spotted unauthorized accounts in June 2026, they initially miscategorized the event as a simple account-creation issue. Subsequent deep-dive forensics concluded on October 19, revealing that unauthorized access to customer records occurred between June 27 and July 2, 2026.

Mitigation and Security Status

DigiCert has taken immediate steps to remediate the vulnerability, including disabling the self-registration feature and implementing stricter access controls. The company reassures customers that its primary certificate authority infrastructure, including issuance platforms and customer login credentials, remains secure.

The firm is currently in the process of auditing the impacted records to identify specific individuals whose identity documents were exposed. Those affected are being notified directly as the internal audit progresses.

Industry Implications

This incident highlights the risks associated with internal system migrations and the importance of strictly enforcing network segmentation. For global enterprises, it serves as a reminder to conduct regular audits of internal tools that may have legacy self-registration or test features enabled, preventing potential exposure of PII (Personally Identifiable Information).