DigiCert Confirms Unauthorized Access to Archived Customer Data
Summary
DigiCert says a server migration exposed an internal system, where an authorization flaw allowed an unauthorized account to access archived customer data, including some identity documents. The company has restricted access and added controls.
Key points
- A February 2025 server migration exposed an internal business system that had previously been accessible only through a VPN.
- The system's self-registration feature and an authorization flaw allowed external accounts to access archived customer information in read-only mode.
- DigiCert says an unauthorized account accessed customer information between June 27 and July 2, 2026; the company confirmed the access after an investigation on October 19.
- Affected records included names, business email addresses, phone numbers, and business addresses; some may also have contained driver's licenses, passports, utility bills, or other identification documents.
- DigiCert says it has restricted system access, disabled self-registration, and added access controls. It says its certificate authority services, CertCentral, DigiCert ONE, customer login credentials, and issued certificates were not compromised.
Article Details
- Victim Organization
- DigiCert
- Incident Type
- Unauthorized read-only access to archived customer information through an internet-exposed internal business system, enabled by an authorization flaw.
- Incident Date
- 2026-06-27
- Disclosure Date
- 2026-11-05
- Data Types Exposed
- Names
- Business email addresses
- Phone numbers
- Business addresses
- Driver's licenses
- Passports
- Utility bills
- Other identity documents containing names and addresses
- Affected Records
- A small portion of archived customer data was affected; the number of affected people or records was not disclosed.
- Operational Impact
- An unauthorized account accessed customer information in read-only mode between June 27 and July 2, 2026. DigiCert said the account could not modify records, approve certificate validations, or issue certificates. DigiCert said its certificate authority services, CertCentral, and DigiCert ONE were not compromised.
- Claim Status
- confirmed
Vendors
Products
CertCentralDigiCert says its certificate authority services, CertCentral, and DigiCert ONE platforms were not compromised, and that customer login credentials and issued certificates remain secure.DigiCert ONEDigiCert says its certificate authority services, CertCentral, and DigiCert ONE platforms were not compromised, and that customer login credentials and issued certificates remain secure.