DigiCert Data Breach Exposes Customer Records and ID Documents After Migration Error

The DigiCert data breach has exposed archived customer information, including some passports and driver’s licences. DigiCert is one of the world’s largest providers of the digital certificates that keep websites secure. According to the company, a 2025 infrastructure migration accidentally left an internal system open to the internet for about 17 months. DigiCert confirmed the breach as reportable on October 19, 2026, and the incident became public this week.

The good news is that the breach did not touch DigiCert’s certificate services. However, a company that people trust to secure the web missed a basic configuration error for well over a year.

What Happened in the DigiCert Data Breach

According to DigiCert’s official incident report on Mozilla’s Bugzilla, the problem started on February 4, 2025. During an infrastructure migration, DigiCert moved an internal business system that stored archived customer records out of a VPN-protected network segment. As a result, anyone on the public internet could reach the system, and nobody carried out a security review.

In addition, the system had a self-registration feature, so anyone who found it could create an account. These new accounts had no application assigned to them. Because of this, they skipped the multi-factor authentication (MFA) that DigiCert staff had to use. Even so, a gap in the permission checks still let them read archived customer records.

Timeline of the Breach

• February 4, 2025: A migration makes the internal system reachable from the internet
• June 18, 2026: DigiCert staff notice accounts that do not belong to employees, but at first believe these accounts cannot access data
• June 21, 2026: A managed security research programme reports the registration issue
• June 27 to July 2, 2026: Outsiders access customer data
• July 2, 2026: An authorisation fix blocks the unassigned accounts
• October 19, 2026: DigiCert confirms the incident is a reportable breach
• October 20, 2026: DigiCert files a preliminary incident report

As GBHackers notes, DigiCert first treated the June discovery as an account creation problem rather than a data access problem. For this reason, the delay is likely to draw criticism from the security community.

What Data Was Exposed

DigiCert says the breach affected only “a small proportion” of its archived data. For the most part, the exposed information includes:

• Names of customer representatives
• Business email addresses
• Phone numbers
• Business addresses

For a small minority of accounts, the data also included identity documents that customers had submitted for verification. According to Cyber Security News, these included passports, driver’s licences and utility bills showing names and addresses.

So far, DigiCert has not said how many people or organisations the breach affected. In the public Bugzilla thread, other participants asked for exact figures. In response, DigiCert offered to share summary statistics on request. The company also says it is reviewing the identity documents and will notify affected individuals once it completes that review.

Are DigiCert Certificates Still Safe?

Yes, according to DigiCert. The company says the breach did not reach its Certificate Authority services, CertCentral or DigiCert ONE. Likewise, customer login credentials and issued certificates remain secure.

Furthermore, investigators found that the unauthorised accounts did not issue, change or revoke any certificates, and they did not alter any validation records. In other words, the intruders could only read data, not change it. Therefore, DigiCert says customers do not need to replace their active certificates.

What DigiCert Has Done to Fix It

Since the breach, DigiCert has taken several steps:

• Turned off self-registration on the affected system
• Moved remaining external endpoints onto private internal network addresses
• Reset all business system passwords
• Added alerts for unusual file access and request volume
• Made security sign-off mandatory for any network access change
• Completed an external penetration test and a least-privilege access review

Overall, DigiCert blamed the incident on three main failures. First, nobody reviewed security during the migration. Second, account monitoring was weak. Finally, the access model did not account for self-registered users.

What Affected Customers Should Do

Stolen business contact details and ID documents are valuable for phishing and identity fraud. For example, attackers can use them to send convincing emails that appear to come from DigiCert or a trusted partner. Moreover, AI tools now make these scams even harder to spot, as explained in our report on why AI-powered cyberattacks are making 2026 breaches more costly.

If your organisation uses DigiCert, it is sensible to:

• Treat unexpected emails or calls about certificates, payments or account changes with caution
• Verify any request by contacting DigiCert through its official website, not links in an email
• Watch for a notice from DigiCert if your identity documents were part of the breach
• Remind staff who manage certificates to report suspicious messages

The Bottom Line

The DigiCert data breach shows that even security companies can fall victim to simple mistakes. In this case, a single unchecked migration left customer records exposed for months. Although DigiCert’s core certificate services stayed safe, the leak of contact details and ID documents still gives scammers useful material. Ultimately, the lesson for businesses is clear: every network change needs a security review, and every exposed account needs strong authentication.