DigiCert notifies customers after archive breach exposed identity documents

DigiCert starts notifying customers

The notice says the exposed information was limited to names, business email addresses, phone numbers and business addresses. Where a customer had supplied proof of identity, it may also have included a driver's license, passport, utility bill or another document carrying a name and address. Cloud architect Fabian Bader posted a copy on X.

That puts the breach in front of a narrow group: people who bought a certificate and uploaded identity paperwork for DigiCert's verification checks. The company says it is still reviewing those documents to establish who was affected and will notify them when the review is complete. It has not disclosed how many people, organisations or documents are involved, and describes the affected part of its archive only as small.

Bader's post was blunt. "Thanks @digicert that your data leak was 'limited' to only my full PII data and potentially any verification documents I submitted for my certificate," he wrote.

DigiCert confirmed the unauthorised access on 19 October 2026 and filed its preliminary incident report the following day. The company says the account had read-only access and could not modify records, approve certificate validations or issue certificates.

How a server migration opened an archive

The root of the problem is a server move on 4 February 2025. An infrastructure migration shifted an internal business system out of a network segment reachable only through a VPN and into an availability zone the internet could reach.

The system carried a self-registration feature built for other applications, so outsiders could create accounts. Those accounts had no application assigned and were not covered by the multifactor authentication DigiCert required of staff, yet an authorization flaw let them read archived information.

Staff spotted non-DigiCert accounts on 18 June 2026, but an initial review wrongly concluded that accounts without an assigned application could not reach data. A report from the company's managed security research program arrived on 21 June. Engineers shipped an authorization fix on 2 July, and investigators later placed the unauthorised access inside the 27 June to 2 July window. DigiCert first suspected archived data had been read on 12 October and confirmed a reportable incident on 19 October. Its report concedes the point: "The incident was initially handled as an account-creation issue rather than a data-access event".

The system sat reachable from the internet from February 2025 until the July fixes, but DigiCert places confirmed data access only inside the window from 27 June to 2 July. Rescana makes the same distinction, noting that the company does not say customer data was being read from February 2025 onwards.

What was exposed and what was not

DigiCert's report describes that group as accounts that included "additional personal data in the form of a customer-provided document".

The boundaries matter for anyone with a certificate in production. DigiCert says its certificate authority services, CertCentral and DigiCert ONE were not compromised, and that customer login credentials and issued certificates remain secure. Investigators found no certificate issuance, validation changes or revocation activity linked to the account, so customers do not need to replace active certificates. Rescana, which published an incident assessment on 6 November, rates the event medium severity with high reach and says emergency certificate replacement is not supported by DigiCert's report.

What DigiCert changed and what happens next

DigiCert restricted access to the affected system, disabled self-registration and added access controls. It also reset business system passwords, moved remaining exposed endpoints behind private network infrastructure and strengthened monitoring.

Application-level file-access and request-volume alerts went in on 15 October.

The report names three contributing factors: a network change made without an adequate security review, monitoring that did not cover business-system account activity, and an authorization model that did not anticipate self-registration. Its stated lesson is that "Authorization for a business system must not be delegated to its network position".

Two remediation items, auditing origin-server exposure and reviewing automated account alerts, were scheduled for completion on 6 November. DigiCert has said it can share summary figures with browser root programs on request, the route by which a count may eventually become public.