Short answer
DigiCert told customers that a February 2025 server migration exposed an internal archive system to the internet, and that an account created through a self-registration feature read archived data between 27 June and 2 July 2026. It confirmed the access on 19 October. DigiCert says certificate issuance and validation were not affected.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | DigiCert |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Certificate authority and digital trust |
| Country | United States |
| Detected | 2026-10-19 |
| Disclosed | 2026-11-05 |
| People or records affected | A small portion of archived customer records; DigiCert has not said how many people |
What data was exposed
- Names, business email addresses, phone numbers and business addresses of customers
- For some people, identification documents such as a driver's license, passport or utility bill
What happened
DigiCert, one of the largest issuers of website security certificates, has begun sending breach notices to customers. Its account, as reported by BleepingComputer and SecurityWeek on 5 and 6 November 2026, is that a server migration in February 2025 moved an internal business system to a network segment from which it was inadvertently reachable from the internet. It had previously been reachable only through a VPN.
How the access worked
The system had a self-registration feature intended for other applications and requiring no multi-factor authentication. Outsiders could use it to create accounts. Those accounts were not assigned to any application, but an authorization flaw let one read archived customer data. DigiCert says the account had read-only access.
The company puts the access between 27 June and 2 July 2026. It blocked the account on 2 July and at first treated the case as an account-creation issue, not a data access event. After a report through its managed security research program, it deployed fixes but did not realize archived data had been read. It began investigating whether customer information had been accessed on 12 October and confirmed it on 19 October.
What was in the archive
Most of the exposed data was business contact information: names, business email addresses, phone numbers and business addresses. For a minority of people, the archive also held documents they had supplied during identity validation, such as a driver’s license, passport or utility bill. DigiCert says it is still reviewing those documents to determine who is affected and will notify them. It has not said how many people were involved.
What DigiCert says was not affected
DigiCert says the unauthorized account could not write records, act as a validation approver, or issue certificates, and that its certificate authority systems run on separate network segments and were not affected. It says CertCentral and DigiCert ONE were not compromised and that customer login credentials and issued certificates remain secure.
Its response includes disabling self-registration, adding monitoring and alerting, removing or verifying non-DigiCert accounts, resetting passwords for all business system users and verifying system ownership and permissions. DigiCert also published an incident report on Mozilla’s Bugzilla tracker, according to BleepingComputer.
This is described as a separate event from DigiCert’s earlier 2026 support portal incident involving code-signing certificates.
What to do
If you are a DigiCert customer and receive a notice, confirm it through a contact you already trust. The main risks are targeted phishing that uses accurate contact details and, for those whose ID documents were archived, identity theft. Our data breach checklist covers fraud alerts and credit freezes, and our guide to phishing messages explains why a message with correct personal details can still be fake. Fake invoices and certificate notices are also covered in our guide to business email scams.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing aimed at business customers that quotes real names, phone numbers and addresses and claims a certificate or validation problem.
- Identity theft attempts using a passport, license or utility bill if one was in your archived file.
- Fake 'DigiCert breach notification' emails that ask you to upload documents or sign in through a link.
What to do if you are affected
- 01Read the DigiCert notification you receive and confirm it came from DigiCert by contacting your account team through a number you already have.
- 02If you gave DigiCert an identity document for validation, place a fraud alert or credit freeze and watch your credit reports.
- 03Be skeptical of any call or email about certificate problems, even one that uses your real details.
- 04Never upload ID documents or enter credentials through a link in an email.
- 05Ask DigiCert which of your records were in the archive if the notification does not say.
Frequently asked questions
What data was exposed?
For all affected records, names, business email addresses, phone numbers and business addresses. For some people, a document they gave DigiCert, such as a driver's license, passport or utility bill showing a name and address.
Were certificates or customer logins compromised?
DigiCert says its certificate authority systems, CertCentral and DigiCert ONE were not compromised, that login credentials and issued certificates remain secure, and that the unauthorized account could not write records, approve validations or issue certificates.
How did the attacker get in?
A February 2025 migration left an internal system reachable from the internet. Its self-registration feature, which needed no multi-factor authentication, let outsiders create an account, and an authorization flaw let that account read archived data.
How many people were affected?
DigiCert has not said. It is reviewing identification documents to identify the specific individuals and says it will notify them. BleepingComputer asked for a count and had no reply at publication.
Sources
- DigiCert data breach exposes customer information, identity documents, BleepingComputer, 2026-11-05
- DigiCert data breach impacts business customer information, SecurityWeek, 2026-11-06
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.