Key Takeaways
- DigiCert said an unauthorized account read part of an archive of customer information on an internal business system between June 27 and July 2, 2026, and that it confirmed the access on October 19, 2026.
- The DigiCert business system became reachable from the internet after a February 4, 2025, server migration, and a self-registration feature let outsiders create accounts that did not require multi-factor authentication, according to DigiCert's incident report.
- Most of the DigiCert records that were read held names, business email addresses, phone numbers, and business addresses, and a small minority also held a document such as a driver's license, passport, or utility bill; DigiCert has not said how many people were affected.
- DigiCert said its certificate authority services, CertCentral, and DigiCert ONE were not affected, that the unauthorized account could not issue certificates, and that customers need to take no action on active certificates.
What happened
DigiCert, a Utah-based certificate authority, reported a data breach involving an internal business system that was left exposed and later accessed by someone outside the company, The Record reported. Certificate authorities issue the digital certificates that help verify the security of web servers.
The system stores information that customer representatives give DigiCert to validate their identity, DigiCert said in its incident report on Mozilla's Bugzilla platform. An unauthorized account read part of that archive between June 27 and July 2, 2026, according to the report.
DigiCert has begun sending breach notifications to affected customers, BleepingComputer reported on November 5, 2026.
How the system was exposed
On February 4, 2025, DigiCert moved the business system out of a network segment that could only be reached through a virtual private network (VPN). The move made the system reachable from outside the company, DigiCert said. It stayed that way for more than 16 months without DigiCert noticing, The Register reported.
A feature for registering new accounts, intended for other uses, was also available on the system. Accounts created through it did not need multi-factor authentication (MFA), a login check that asks for a second proof of identity, and they could read archived data, according to DigiCert.
DigiCert gave this timeline in its report:
| Date | Event |
|---|---|
| February 4, 2025 | A migration makes the system reachable from outside DigiCert. |
| June 18, 2026 | DigiCert staff see accounts that do not belong to DigiCert but conclude they have no data access. |
| June 21, 2026 | A report through DigiCert's managed security research program warns that outsiders can create accounts. |
| June 27 to July 2, 2026 | The unauthorized account reads archived data. |
| July 2, 2026 | DigiCert releases a fix that blocks the access. |
| October 12, 2026 | DigiCert first suspects that archived data was accessed. |
| October 19, 2026 | DigiCert confirms the access and finds it must be reported. |
DigiCert said the problem was not caught earlier because the migration "was treated as an infrastructure change rather than a security change." The incident "was initially handled as an account-creation issue rather than a data-access event," the company wrote.
What data was exposed
Most of the records were business contact details: names, business email addresses, phone numbers, and business addresses, DigiCert said. A small minority of customer accounts also held a document such as a driver's license, passport, or utility bill. The Record and BleepingComputer reported the same categories of data.
DigiCert has not disclosed how many customers or individuals were affected, The Register reported. In its notice to customers, DigiCert said it was "completing a review of identification documents to determine the specific individuals involved" and would notify those people when the review was done, according to The Register.
Several people shared DigiCert's breach notices on social media, and some posts raised concern that attackers could tie identity documents to specific certificates, The Record reported.
DigiCert's response
DigiCert said the unauthorized account could not change records, approve validations, or issue certificates. A review of logs found no validation, certificate issuance, or revocation activity tied to the account, according to the report. DigiCert said its certificate authority services, CertCentral, and DigiCert ONE were not affected, and that customer login credentials and issued certificates remain secure.
"To our knowledge, there is no evidence of misuse of the information involved," a DigiCert spokesperson told The Record, adding that the company had reported the incident to law enforcement. The spokesperson declined to say whether the attackers had contacted DigiCert.
Since the breach, DigiCert has reset passwords for all users of the system, turned off self-registration, moved the remaining exposed parts of the system onto internal networks, and added alerts for unexpected account creation, according to its report. DigiCert had to report the breach under rules set by Mozilla, Google Chrome, Microsoft, and Apple, The Record noted.
What customers should know
DigiCert said in its report that "no action is needed from customers regarding active certificates and continued use of DigiCert services." The company said it has contacted the affected customers with information specific to them.