DigiCert discloses breach exposing customer identity papers
DigiCert, one of the world's largest certificate authorities, has told customers it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet. The disclosure, reported on 5 November 2026, affects a small portion of archived customer data, including names, business email addresses, phone numbers and business addresses — and identity documents, such as a driver's licence, passport or utility bill, where customers had provided them.
How the breach happened
The root of the incident dates to a server move on 4 February 2025, which left an internal system previously reachable only over VPN exposed to the internet. DigiCert first discovered unauthorised accounts on the exposed system in June 2026, but initially judged they could not reach customer information, treating it as a minor account-creation issue. Only on 12 October did the company suspect archived data had been read; on 19 October an investigation confirmed an unauthorised account had accessed customer information between 27 June and 2 July 2026.
What DigiCert says is safe
DigiCert says the intruder had read-only access and could not modify records, approve certificate validations or issue certificates. Its core services, CertCentral and DigiCert ONE, were not compromised, and customer login credentials and issued certificates remain secure, the company says. The firm has disabled the self-registration feature that allowed the unauthorised accounts to be created and has tightened access controls. It has begun sending breach notifications to affected customers.
DigiCert has not said how many people are affected; its incident report, filed on Mozilla's Bugzilla platform, says only that it can share summary figures with browser root programmes on request, and BleepingComputer said it had received no count when it published.
Sources: BleepingComputer, DigiCert data breach exposes customer information, identity documents, 5 November 2026; SC Media, DigiCert reports data breach following server migration error, 5 November 2026.
