DigiCert Breach Exposed Customer Identity Documents Through Publicly Accessible Archive
Summary
DigiCert says a system migration exposed an internal customer archive to the internet. Outsiders created accounts and accessed records, including some identity documents; the company detected the intrusion in June 2026 and later blocked external access.
Key points
- DigiCert moved an internal archive from behind a VPN to a publicly accessible network zone in February 2025 and detected the intrusion in June 2026.
- An exposed account-registration feature let outsiders create accounts without multifactor authentication; those accounts had read access to the archive.
- Exposed records included names, business email addresses, phone numbers and business addresses. Some included driver's licenses, passports or utility bills.
- DigiCert said no login credentials or DigiCert-issued certificates were affected, and its Certificate Authority services, CertCentral and DigiCert ONE were not affected.
- DigiCert said it initially misjudged the unauthorized account’s access; a managed security program alerted the company to the flaw, and it identified the attack path days later.
- The company placed the archive behind a web application firewall, blocked external account creation and added a SIEM alert for blocked access attempts.
Article Details
- Victim Organization
- DigiCert
- Incident Type
- Unauthorized access to and exfiltration of customer information from an internal archive after a system migration inadvertently exposed it to the internet.
- Data Types Exposed
- Names
- Business email addresses
- Phone numbers
- Business addresses
- Identity verification documents, including driver's licenses, passports, and utility bills
- Affected Records
- A portion of customer records was exposed; the number of affected records was not disclosed.
- Affected Data Size
- Not disclosed
- Operational Impact
- The internal archive was accessible to outsiders through externally registered accounts with read access. DigiCert said its Certificate Authority services, CertCentral, and DigiCert ONE were not affected. The archive was subsequently placed behind a web application firewall, and external account creation was blocked.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
People
Donovan FarrellA security engineer who commented on the potential account-reset risks posed by exposed identity documents and recommended protective steps.Fabian BaderA security architect who said his personal information and potentially submitted identity verification documents were exposed in the breach.
Vendors
Products
CertCentralNo login credentials or DigiCert-issued certificates were affected, the firm said. DigiCert's Certificate Authority services, CertCentral and DigiCert ONE were not affected.DigiCert ONENo login credentials or DigiCert-issued certificates were affected, the firm said. DigiCert's Certificate Authority services, CertCentral and DigiCert ONE were not affected.