DigiCert, one of the largest public certificate authorities, has confirmed a data breach after an internal business system that archives customer-provided information was mistakenly left reachable from the internet following a server migration. An unauthorized account was able to read a portion of the archived data, which included business contact details and, for some customers, identity documents such as passports and driver’s licenses.
The company disclosed the incident in a self-reported incident report on Mozilla’s Bugzilla, where certificate authorities file compliance incidents for the browser root programs. DigiCert filed a preliminary report on October 20, 2026 and posted its full incident report on November 1. Customers began receiving breach notification emails this week.
How the system was exposed
According to DigiCert, the problem began on February 4, 2025, when the business system was moved from a VPN-restricted network segment to a different availability zone as part of an infrastructure migration. The move made the system reachable externally, which was never intended.
The business system runs on an account manager platform that DigiCert also uses for customer-facing products. A self-service registration feature built for other use cases was inadvertently available on this instance, so outsiders could create accounts. Those self-registered accounts were not subject to the multi-factor authentication DigiCert requires of its own staff and were set to read-only by default. Even though they had no application assigned, they could still read archived data.
DigiCert said the migration was treated as an infrastructure change, so it got no security review, and the system lacked alerting for new accounts or unusual request volumes.
Timeline of the breach
- June 18, 2026: DigiCert staff noticed non-DigiCert accounts on the system but concluded they had no data access because no application was assigned. The system was placed behind a web application firewall to block new external sign-ups.
- June 21, 2026: A report through DigiCert’s managed security research program flagged that accounts could be created through external access.
- June 27 to July 2, 2026: The window in which the unauthorized account accessed archived data, as later established from file access and request volume logs.
- July 2, 2026: DigiCert released an authorization fix that blocks accounts with no assigned application.
- October 12, 2026: DigiCert first suspected that archived data had actually been accessed.
- October 19, 2026: DigiCert confirmed unauthorized access to a subset of archived data and deemed it a reportable event.
“The incident was initially handled as an account-creation issue rather than a data-access event,” DigiCert acknowledged in its report.
What data was exposed
DigiCert said the incident affected “only a small proportion of archived data.” Most of it was business contact information: names, business email addresses, phone numbers and business addresses. A “small minority” of customer accounts also included a customer-provided document such as a driver’s license, passport, utility bill or other document showing a name and address.
The customer notification says the information “may have included an identification document such as a driver’s license, passport, utility bill or other document with name and address,” according to a copy of the notice shared publicly by a recipient. The notice also says DigiCert is still reviewing the identification documents and will contact affected individuals once that review is complete.
DigiCert has not disclosed how many people, organizations or documents were involved. Its report says summary statistics contain personal data and will only be shared with root program representatives on request. On November 5, a participant in the Bugzilla thread asked DigiCert to confirm whether subscriber verification information was exposed and to provide numbers on the data set. DigiCert had not publicly answered at time of publication and has not said who created the account.
Certificates and CA systems not affected
DigiCert stressed that its certificate authority services, CertCentral and DigiCert ONE were not affected, and that customer login credentials and DigiCert-issued certificates “remain secure, valid, and fully trusted.” The account could not write records, act as a validation approver or issue certificates. A review of CA and validation logs found no validation actions, certificate issuance or revocation tied to the account, and customers do not need to replace active certificates.
DigiCert’s remediation
Beyond the July authorization fix, DigiCert says it has:
- Restricted the system’s hostnames to VPN traffic only at the web application firewall (July 9)
- Required security sign-off for any network accessibility change to internal tools (August 28)
- Completed an external penetration test of the system and related internal tools (August 31)
- Added file access and request volume alerts routed to its security operations center (October 15)
- Reset passwords for all business system users (October 17)
- Disabled self-registration and moved remaining endpoints onto private-IP load balancers and internal hostnames (October 24)
- Completed a least-privilege review so each endpoint checks application assignment and role (October 30)
A final audit confirming no business system origin server is externally reachable, and a review of alerting for unexpected account creation, are due on November 6.
What customers should do
Affected customers should watch for targeted phishing that impersonates DigiCert or references certificate orders and validation. Anyone told their ID document was involved should consider monitoring their credit reports.
The incident adds to a run of confirmed breaches at technology vendors, including the DreamHost File Manager breach, the WorkOS internal sales tool breach and the Chainstack customer data breach.
