● Covered by 3 sources · 3 reportsMedium impact2 negative1 neutral
DigiCert data breach exposes customer information and identity documents
Key points
- DigiCert server migration exposed an internal business system.
- Unauthorized access to archived customer data occurred.
- Exposed data includes PII and identity documents for some.
- DigiCert is notifying affected customers.
- The internal system was moved to a different network segment in February 2025.
- Attackers used a self-registration feature to create a read-only account.
- The unauthorized account was blocked on July 2.
- DigiCert determined in October that the account accessed archived customer contact information.
- The accessed data included phone numbers and business addresses.
- The incident occurred between June 27 and July 2, 2026.
- DigiCert posted a post-mortem on Mozilla's Bugzilla platform.
- The issue was fixed by July 2.
- On October 19, DigiCert confirmed the database access was a reportable event.
Data Breach Details
DigiCert has confirmed a data breach resulting from a server migration that inadvertently exposed an internal business system to the internet. This exposure allowed unauthorized parties to access archived customer information. The company is currently sending data breach notifications to affected individuals.
Exposed Information
The breach affected a portion of DigiCert's archived customer data. This includes names, business email addresses, phone numbers, and business addresses. For some customers, the exposed records also contained personal identification documents such as driver's licenses, passports, and utility bills, which were submitted for verification purposes.
Cause of the Breach
According to an incident report on Mozilla's Bugzilla platform, a server migration in February 2025 mistakenly made an internal business system accessible via the internet; previously, it was only accessible through a VPN. This system had a self-registration feature intended for other applications, which external users exploited to create accounts. An authorization flaw then allowed these accounts to access archived customer information in read-only mode.
Discovery and Response
DigiCert first detected unauthorized accounts on the exposed system in June 2026 but initially believed no customer information was accessible. Following a report from its managed security research program, DigiCert deployed security fixes to restrict access and address the authorization flaw. However, it was not until October 19 that further investigation confirmed an unauthorized account had accessed customer information between June and October.
Updates
- The internal system was moved to a different network segment in February 2025.
- Attackers used a self-registration feature to create a read-only account.
- The unauthorized account was blocked on July 2.
- DigiCert determined in October that the account accessed archived customer contact information.
- The accessed data included phone numbers and business addresses.
- The incident occurred between June 27 and July 2, 2026.
- DigiCert posted a post-mortem on Mozilla's Bugzilla platform.
- The issue was fixed by July 2.
- On October 19, DigiCert confirmed the database access was a reportable event.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Certificate authority DigiCert disclosed a data breach where an internal business system, containing customer names, email addresses, phone numbers, and identity documents, was externally accessible. The incident, which occurred between June 27 and July 2, 2026, was due to a system migration that moved the system outside a VPN-restricted network without proper security review. DigiCert's certificate authority services and customer login credentials were not affected, and there is no evidence of data misuse.
DigiCert disclosed a data breach affecting its business customers' contact information, including names and email addresses, and in some cases, identity documents. An internal system, inadvertently exposed to the internet, allowed attackers to create a read-only account and access archived data between June 27 and July 2.
DigiCert experienced a data breach where a server migration exposed an internal system, allowing unauthorized access to archived customer data. The exposed data includes names, business email addresses, phone numbers, business addresses, and for some, personal identification documents like driver's licenses and passports. DigiCert is notifying affected customers and investigating the full extent of the breach.