DigiCert says a data breach exposed archived customer information after an internal business system became reachable from the internet. The company said the incident did not compromise its certificate-authority operations, issued certificates or customer login credentials.
The affected records included names, business email addresses, phone numbers and business addresses, according to DigiCert's incident report and reporting by BleepingComputer. Some records also contained identity documents, including passports, driver's licenses, utility bills or other documents listing a name and address. DigiCert has not disclosed how many people, organizations or documents were affected.
The distinction is material. The breached system held archived business data, while DigiCert said its CertCentral and DigiCert ONE products, certificate issuance and validation systems, and customer sign-in credentials were unaffected. The company said the unauthorized account could view records but could not alter them, approve validations or issue certificates.
How did the DigiCert data breach happen?
According to the company's report, DigiCert moved the system from a VPN-restricted network to an externally accessible environment during a February 2025 infrastructure migration. That move exposed a self-registration route intended for other uses of the account-management platform.
Accounts created through that route were not subject to the multifactor authentication used by DigiCert employees. Although they had no application assignment, an authorization problem gave them read-only access to archived customer records, according to GBHackers' account of the incident report.
DigiCert first found nonemployee accounts on June 18, 2026, but initially concluded that accounts without an assigned application could not reach customer data. A report through its managed security research program on June 21 prompted more investigation. DigiCert later determined that unauthorized access occurred between June 27 and July 2, 2026, and confirmed on October 19 that the incident was reportable.
The company identified the migration review, limited account-activity monitoring and authorization design as contributing factors. In its report, DigiCert said the migration had been handled as an infrastructure change rather than a security change, avoiding the more detailed review that would have accompanied the latter.
What is DigiCert doing after the breach?
DigiCert has disabled self-registration, restricted the affected system's access, moved exposed endpoints behind private infrastructure, reset business-system passwords and added access controls and monitoring, according to Cyber Security News and BleepingComputer.
BleepingComputer reported that DigiCert has begun notifying affected customers and is reviewing identity-document records to determine affected individuals and notify them. The available reporting identifies neither the party that accessed the records nor a confirmed misuse of the information. A DigiCert spokesperson told Recorded Future News that the company knew of no evidence of misuse and had reported the incident to law enforcement.
For now, the unanswered parts are the scope of the breach and what happened to the data after it was read. DigiCert has described a small portion of archived customer data, but has not published a count.
This story draws on original reporting from The Record.
