US Certificate Authority DigiCert Confirms Data Breach Exposing Customer Identity Documents
DigiCert confirmed on November 5 that a server migration misconfiguration exposed internal systems, leading to unauthorized access to customer contact details and identity verification documents between June and July 2026.
US-based certificate management company DigiCert confirmed on November 5 that a data breach occurred due to a configuration error during a server migration in February 2025. This error inadvertently exposed an internal business system, originally accessible only via VPN, to the internet. Attackers exploited an authorization control vulnerability to create unauthorized accounts and gain read-only access to archived customer data.
According to notifications sent to affected customers, the leaked information includes names, corporate email addresses, phone numbers, and company addresses. Because some customers had previously provided identity verification documents to complete certificate validation procedures, the breach may also have exposed driver's licenses, passports, utility bills, and other documents containing names and addresses.
In an incident report submitted to Mozilla Bugzilla, DigiCert stated that it first discovered unauthorized accounts in the system in June 2026 but initially believed they could not access customer information because they lacked application assignments. It was only after receiving reports through its security research program that the company confirmed external actors could create new accounts. Further investigation on October 19 confirmed that unauthorized accounts had accessed customer data between June 27 and July 2, 2026.