DigiCert Breach Exposes Customer Information and Identity Documents

Certificate authority DigiCert has warned of a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorised access to customer records and identity documents. The incident compromised archived customer data, including names, business email addresses, phone numbers, and business addresses. For some individuals, the exposed records included personal identification documents such as driver's licences, passports, and utility bills. DigiCert stated that its certificate authority services, CertCentral, and DigiCert ONE platforms were not compromised, and customer login credentials and issued certificates remain secure.

Key Facts

How Did the Unauthorised Access Occur?

A February 2025 server migration mistakenly exposed an internal business system to the public internet without requiring VPN access. An account self-registration feature, coupled with an authorization flaw, subsequently enabled external users to register and view archived customer data in read-only mode between 27 June and 2 July 2026.

According to an incident report filed on Mozilla's Bugzilla platform, the internal business system was previously accessible exclusively through a virtual private network. Although accounts created via the self-registration feature were not assigned to specific applications, an authorization flaw permitted them to view archived customer records in read-only mode. DigiCert initially identified unauthorised accounts on the system in June 2026, but treated the matter as an account-creation issue after determining the accounts lacked application assignments. Following a report via its managed security research program, DigiCert implemented access controls and addressed the flaw, later confirming on 19 October that an unauthorised account had accessed archived records during the June-July window.

DigiCert confirmed an unauthorized account accessed archived customer records between 27 June and 2 July 2026.

Were Core Certificate Services Compromised?

No cryptographic systems or core certificate authority operations were compromised during the incident. DigiCert confirmed that the unauthorised account had strictly read-only permissions on the exposed archive system and lacked any ability to modify data, validate certificate requests, approve issuances, or access customer login credentials.

The company stated that certificate authority services, CertCentral, and DigiCert ONE platforms were not affected by the misconfiguration. The incident was isolated to the legacy internal business system, meaning cryptographic keys, issued certificates, and account credentials remained unaffected. DigiCert has since restricted access to the affected system, disabled the self-registration functionality, and applied additional access controls to prevent further exposure.

DigiCert stated that customer login credentials, CertCentral, DigiCert ONE, and issued certificates remain secure.

What Should You Do?

• Review breach notifications: Monitor incoming communications from DigiCert to determine whether personal verification documents or business contact records were among the exposed archives.
• Exercise vigilance against phishing: Watch for targeted phishing campaigns, business email compromise attempts, or unsolicited communications exploiting exposed contact details or identity documents.
• Report suspicious activity: Malaysian organisations and individuals who encounter suspected identity fraud or scams can contact the National Scam Response Centre at 997 or report incidents to Cyber999 (MyCERT).

Common Questions

What customer information was exposed in the incident?

The exposed records involved archived customer information, including names, business email addresses, telephone numbers, and business addresses. For certain individuals, the exposure also contained personal identification documents submitted for verification, such as passports, driver's licences, and utility bills.

When did the unauthorised data access occur?

Although the server migration occurred in February 2025 and unauthorized accounts were noted in June 2026, DigiCert's investigation confirmed that an unauthorized account accessed archived customer information between 27 June and 2 July 2026, before access was subsequently blocked.

Were issued certificates or passwords affected?

No. DigiCert stated that customer login credentials and issued certificates were not compromised. The affected account possessed only read-only access to the internal archive system and could not modify records, approve validations, or access certificate authority systems.

Sources and Methodology

This dispatch is based solely on reporting published by BleepingComputer on 5 November 2026. ROCKSTARmedia Infosec has not reviewed, verified, or checked any secondary documentation, external advisories, or vendor pages beyond the provided source report.