DigiCert has disclosed a data breach involving one of its internal business systems, which stored archived customer information and sensitive identity documents. The breach exposed names, business email addresses, phone numbers, and business addresses. A smaller number of accounts contained documents like passports, driver’s licenses, and utility bills. The affected data comes solely from archived records; active certificates and authentication systems remain intact.
How the Exposure Happened
The issue began during a system migration on February 4, 2025, when an internal system was moved to a different availability zone. This change unintentionally made the system accessible over the internet without having completed a full security review. Around the same time, an account registration feature—originally designed for other uses—was left enabled without enforced multifactor authentication. This feature allowed newly created accounts to gain read-only access to archived records, creating a significant permissions gap.
Investigators first spotted non-DigiCert accounts accessing the system on June 18, 2026. An initial evaluation asserted that unassigned accounts couldn’t reach customer data, but this conclusion proved incorrect. Though a web application firewall blocked new registrations through the exposed path, existing account access persisted. A full security assessment confirmed the issue and a code fix was released on July 2. Unauthorized read access likely occurred between June 27 and July 2.
Scope, Impact, and Response
The breach is limited to a subset of archived data. There’s no indication that live services—such as CertCentral, DigiCert ONE, certificate issuance, validation, or revocation—were affected. No active certificates need replacement. Customer login credentials were not compromised.
DigiCert first registered signs of unauthorized data exposure on October 12. Logs and audit trails helped define the window of exposure. After confirming the breach on October 19 and filing a preliminary incident report on October 20, the company disabled self-registration, relocated exposed endpoints to private infrastructure, reset system passwords, tightened monitoring, and completed a thorough permissions audit. They also reinforced policies for any network changes to trigger security approval.
Notably, this incident is distinct from earlier DigiCert security issues—such as a support-system breach that impacted code-signing certificates, and a 2024 DNS validation error that required certificate rollovers. The underlying lesson here is clear: even systems thought to be protected by network architecture or internal policies must enforce strict authorization checks for any feature that handles sensitive data.
Why this matters: Identity documents and personally identifiable information (PII) are high-risk assets. Even archived data can pose threats. By misconfiguring access controls and overlooking MFA, DigiCert created an avoidable vulnerability. For customers, the lack of impact on active certificates is a relief, but the breach raises questions about data lifecycle management and internal controls at major certificate authorities.
What to watch: Whether any regulatory actions or fines will follow. How quickly DigiCert completes notification to individuals who had identity documents exposed. And whether this episode prompts stricter governance across the certificate authority industry—especially on permissions enforcement, external exposure reviews, and internal tools.
