November 5, 2026: DigiCert, one of the largest certificate authorities, has started notifying customers that an unauthorized account read archived customer records on an internal business system between June 27 and July 2, 2026. For some customers the records included identity documents such as passports, driver's licences or utility bills. DigiCert says its certificate authority systems and issued certificates were not affected. The catalog entry records the details.
What happened
In February 2025, a server migration moved an internal business system out of a segment that could only be reached over VPN and into a zone reachable from the internet. The system had a self-registration feature meant for other applications. Accounts created that way were not attached to any application, but an authorization flaw still let them read archived customer records.
DigiCert first spotted unauthorized accounts on the system in June 2026. Because the accounts were not assigned to an application, it concluded at the time that they could not reach customer data. A report through DigiCert's security research program then warned that outsiders could create accounts, and the company deployed fixes. A later investigation found that one account had in fact read customer records from June 27 to July 2, and DigiCert confirmed the data access on October 19. In its words, the incident "was initially handled as an account-creation issue rather than a data-access event."
DigiCert has since restricted access to the system, turned off self-registration and added access controls. Notices started reaching customers around November 5. One was posted publicly on X.
What data was involved
- Names, business email addresses, phone numbers and business addresses.
- For a smaller set of customers, identity documents supplied during certificate validation: passports, driver's licences or utility bills.
DigiCert describes the affected data as "a small portion" of its archived customer data. It has not said how many customers or documents were involved. It says it is still reviewing the identity documents to work out which individuals to notify.
What was not affected
DigiCert says the account had read-only access. It could not change records, approve validations or issue certificates. The company says CertCentral, DigiCert ONE, customer login credentials and issued certificates are secure. This is a separate incident from the April 2026 support-channel attack, in which social engineering led to unauthorized EV code-signing certificates (catalog entry).
Verified and unverified
- Confirmed by DigiCert: the migration error, the access window, the data types, the read-only access, the fixes and the notifications.
- Unknown: how many customers and documents were involved, who created the account, and whether the data has been used or published. No group has claimed the access.
Who is at risk
The contact data is business information, so the main risk is targeted phishing aimed at the people who manage certificates: fake renewal notices, fake validation requests and invoice fraud using real names and account details. People whose passport or licence scans were taken face a higher risk of identity fraud, since those documents can be used to open accounts or pass verification checks elsewhere.
What to do
- Read any DigiCert notice carefully, and check it by logging in to CertCentral directly rather than through links in an email.
- Treat unexpected renewal, payment or validation emails as suspect, even when they use correct names and order details. Confirm through your account manager or the portal.
- If you sent DigiCert an identity document, watch for a second notice. Consider a credit freeze, and report the document to the issuing authority if the notice confirms it was taken.
- Make sure the certificate admins on your account use multi-factor authentication, and review the authorized contacts list.
- Warn your finance team about invoice and bank-detail-change requests that claim to come from DigiCert.
Sources
- BleepingComputer, "DigiCert data breach exposes customer information, identity documents," November 5, 2026
- OODA Loop brief, November 5, 2026
Sourcing note: the timeline and quotes come from DigiCert's customer notice as reported by BleepingComputer. DigiCert has not published a count.