DigiCert experienced a data breach following a server migration that mistakenly exposed an internal business system to the internet. This incident affected a small portion of DigiCert's archived customer data, including names, business email addresses, phone numbers, and business addresses.
Some of the exposed records contained personal identification documents such as driver's licenses, passports, and utility bills. The breach occurred after the internal business system was moved to a different network segment in February 2025, inadvertently becoming accessible online.
Attackers exploited a self-registration feature to create a read-only account, accessing archived data between June 27 and July 2, 2026. DigiCert blocked the unauthorized account on July 2, 2026, but the access to archived data was not discovered until October 19, 2026.
The unauthorized account had read-only access, preventing any modification of records, certificate validation approvals, or certificate issuance. DigiCert's certificate authority services, CertCentral, and DigiCert ONE platforms remained uncompromised.
DigiCert has started notifying affected customers about the data breach. In response to the incident, DigiCert implemented additional monitoring and alerting measures, reset passwords for all business system users, and deactivated the self-registration feature.