DigiCert has confirmed a data breach involving an internal business system that held archived customer contact details and identity documents. The certificate authority says only a small proportion of its archived data was affected and that it confirmed the unauthorized access on October 19, according to Cyber Security News.
The exposure traces back to February 4, 2025, when DigiCert moved the system out of a VPN-restricted network segment. The move accidentally made it reachable from the internet without a security review. An account registration feature meant for other parts of the account management platform let outside users create accounts, which skipped the multifactor authentication required of DigiCert staff and, because of a gap in permission checks, received read-only access to archived records.
Staff noticed non-DigiCert accounts on June 18, 2026, but an initial review wrongly concluded that accounts without an assigned application could not reach data. Unauthorized access took place between June 27 and July 2, and a fix shipped on July 2. DigiCert first suspected access to archived information on October 12 and used retained logs to rebuild the timeline.
The exposed records include names, business email addresses, phone numbers and business addresses. In a small minority of accounts they also include passports, driver’s licenses, utility bills or other documents showing names and addresses. DigiCert’s public report does not say how many people, organizations or documents were affected.
DigiCert says its certificate authority services, CertCentral and DigiCert ONE were not affected, that customer login credentials and issued certificates remain secure, and that investigators found no certificate issuance, validation change or revocation tied to the unauthorized accounts. Customers do not need to replace active certificates. The company has disabled self-registration, moved the remaining exposed endpoints behind private network infrastructure, reset business system passwords and added a security approval step for network access changes. It is reviewing identity documents to identify affected individuals and plans to notify them when that review is done.