DigiCert confirmed a breach in an internal business system that held archived customer contact details and identity documents. The company said the exposed information covered only a small share of its archived data, and its public report did not give a total count of affected people, organizations, or documents.
Unauthorised access to archived records
The exposure involved names, business email addresses, phone numbers, and business addresses. A small minority of affected accounts also held passports, driver’s licenses, utility bills, or other documents that showed names and addresses.
DigiCert said the incident did not affect its Certificate Authority services, CertCentral, or DigiCert ONE. It also said customer login credentials and issued certificates remained secure. Investigators found no certificate issuance, validation changes, or revocation activity tied to the unauthorized account, and customers did not need to replace active certificates because of the incident.
How the internal system became exposed
The exposure began with an infrastructure migration on February 4, 2025, when DigiCert moved the business system from a network segment restricted by a virtual private network, or VPN, to another availability zone. That change made the internal system reachable from the internet without a security review of its new exposure. An account registration feature, which was meant for other uses of the account management platform, also became available.
Accounts created through that feature were not covered by the multifactor authentication required for DigiCert staff. They had no application assigned, yet they still received read-only access to archived information, which revealed a gap in permission checks. The company later said this access was limited to reading records and did not allow changes, identity check approvals, or certificate issuance.
What investigators found and when
According to DigiCert’s incident report, staff noticed non-DigiCert accounts on June 18, 2026. An initial review wrongly concluded that accounts without an assigned application could not access data. A web application firewall blocked new registrations through the external access path, but existing access remained a concern.
A report from DigiCert’s managed security research program followed on June 21, and engineers confirmed the registration issue. The company released an authorization fix on July 2. Investigators later determined that unauthorized data access took place between June 27 and July 2, and DigiCert first suspected access to archived information on October 12. Retained logs and audit records helped reconstruct the access window and connect the activity to the account.
Response and remaining checks
DigiCert disabled self-registration, moved the remaining exposed endpoints behind private network infrastructure, reset business system passwords, and strengthened monitoring. It also completed a permissions review and required security approval for network access changes. The report’s action items also include more checks on external exposure and account alerts.
Troy Hunt shared DigiCert’s notification on X and quoted the email asking, “Anyone else get one of these from @digicert?” The email said the company was reviewing identity documents to identify affected individuals and would notify them once that review was complete.
DigiCert said this disclosure concerns archived customer information, not compromised certificate operations. It also said the case differs from an earlier DigiCert support-system breach involving code-signing certificates and the 2024 DNS validation error that required certificate replacements.
Licensed under CC BY-ND 4.0 International