2026 DigiCert — exposed internal system let an outside account read archived customer records and some identity documents

Data compromised

Names, business email addresses, phone numbers and business addresses. For a smaller set of customers, identity documents provided during validation, such as passports, driver's licences or utility bills. DigiCert says the access was read-only and that its certificate authority services, CertCentral, DigiCert ONE, customer login credentials and issued certificates were not affected. It has not said how many customers or documents were involved.

Technical writeup

Root cause

A February 2025 server migration moved an internal business system from a VPN-only segment to an internet-reachable zone. The system had a self-registration feature, and accounts created through it were not tied to any application, but an authorization flaw let them read archived customer records. DigiCert found unauthorized accounts in June 2026 and first concluded they could not reach customer data. A report through its security research program later warned that outsiders could create accounts, and fixes were deployed. A further investigation confirmed on October 19, 2026 that one account had read customer data between June 27 and July 2, 2026. DigiCert says the incident "was initially handled as an account-creation issue rather than a data-access event."

References

• https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/
• https://oodaloop.com/briefs/cyber/digicert-confirms-data-breach-exposing-archived-customer-data-and-identity-documents/