Skip to content
DigiCert Data Breach Exposes Customer Information and Identity Documents

DigiCert Data Breach Exposes Customer Information and Identity Documents

First seen 5 Nov 2026, 22:50 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 03:43 UTC
  • •DigiCert's data breach exposed customer PII and identity documents due to a server migration error.
  • •Unauthorized access occurred between June 27 and July 2, 2026, affecting archived customer data.
  • •DigiCert's core services remain secure, with no unauthorized changes or certificate issuance reported.

DigiCert reported a data breach that exposed customer information and identity documents due to a server migration error. The breach occurred after an internal system was mistakenly made accessible over the internet, allowing unauthorized access to archived customer data between June 27 and July 2, 2026. Affected data includes names, business email addresses, phone numbers, and in some cases, personal identification documents like passports and driver's licenses. DigiCert began notifying affected customers in early November 2026 and is still reviewing the extent of the breach. The company has since disabled self-registration and implemented stricter access controls. DigiCert confirmed that its core certificate authority services were not compromised during the incident. The breach was initially misclassified as a minor account-creation issue before further investigation revealed the data access. No specific number of affected customers has been disclosed.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3h ago How this analysis works

Timeline

2025-02-04
Server migration exposed internal system
DigiCert moved an internal system to a publicly accessible network segment, allowing unauthorized access.
BleepingComputer
2026-06-18
Unauthorized accounts discovered
DigiCert identified unauthorized accounts on the exposed system but initially misclassified the issue.
2-Spyware
2026-10-19
Breach confirmed
DigiCert confirmed that unauthorized access to customer data had occurred between June 27 and July 2, 2026.
Cybersecurityconnect.Au
2026-11-05
Customer notifications begin
DigiCert started sending notifications to affected customers regarding the data breach.
BleepingComputer

More articles in this cluster (7)

Following this threat?

Track DigiCert in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3

Common questions

What customer data was exposed?
The breach exposed names, business email addresses, phone numbers, and in some cases, identity documents like driver's licenses and passports.
How did the breach occur?
The breach occurred due to a server migration that mistakenly made an internal business system accessible over the internet.
What actions has DigiCert taken since the breach?
DigiCert has disabled self-registration, restricted access to the affected system, and is notifying affected customers.