DigiCert Data Breach Confirmed: Customer Data and Passports Exposed — What DigiCert Customers Should Do

UPDATE — 9 November 2026: DigiCert has now confirmed its final audit work is complete. In follow-up comments on Mozilla Bugzilla, the company confirmed both remaining action items are done: the internal audit that no business-system origin server is externally accessible, and the final review of automated alerting for unexpected account creation. DigiCert also says it has contacted the affected customers with information specific to them and has reported the incident to law enforcement. One thing is still not public: the number of affected customers. When a root-programme representative asked for the numbers, DigiCert said only that summary statistics are available to Root Program representatives on request — no public count has been published. The full incident report also spells out the root cause in detail: a "five whys" analysis named three contributing factors — the migration changed network accessibility without a security review; monitoring was never reassessed after the move, so there was no alert for new account creation; and the authorisation model never contemplated self-registration, so an account with no application assigned could still read the archive. Remediation is now complete too: self-registration was deactivated on 24 October, the remaining endpoints were moved onto private-IP load balancers the same day, a named owner for the system's security posture was assigned on 29 October, and a least-privilege review of the permissions model finished on 30 October.

Image: Wikimedia Commons — DigiCert logo

TL;DR: DigiCert, one of the world's largest certificate authorities, has confirmed a data breach affecting an internal business system. Archived customer details — names, business emails, phone numbers and addresses — were accessed between 27 June and 2 July 2026, and a small number of accounts also had identity documents such as passports and driver's licences exposed. DigiCert says its certificate authority services, CertCentral and DigiCert ONE were not affected, and customers do not need to replace active certificates.

📌 Key Highlights

• DigiCert confirmed unauthorised access to an internal system holding archived customer information, disclosed via its incident report on Mozilla Bugzilla on 5 November 2026.
• The exposure began with a February 2025 infrastructure migration that moved the system from a VPN-restricted network segment to a publicly accessible one.
• Exposed data includes names, business email addresses, telephone numbers and business addresses; a small minority of accounts also had passports, driver's licences or utility bills exposed.
• DigiCert says certificate authority services, CertCentral, DigiCert ONE, customer login credentials and issued certificates were NOT affected — no certificate replacement is needed.
• DigiCert has completed its final audit and all 13 action items; affected customers have been contacted and the incident reported to law enforcement. The number of affected customers is still not public.

What happened in the DigiCert data breach?

DigiCert has confirmed a data breach involving unauthorised access to an internal business system that stored archived customer information, including identity documents in some cases. The disclosure came through the company's incident report published on Mozilla Bugzilla, and was first reported by security outlets on 5 November 2026.

The root cause was a security misconfiguration dating back to 4 February 2025, when an infrastructure migration moved the affected system from a VPN-restricted network segment into an externally accessible availability zone — effectively exposing the application to the internet.

DigiCert's own team noticed externally created accounts linked to the system on 18 June 2026, but initially concluded that accounts without application assignments could not access data. That assessment was wrong: investigators later found a separate authorisation failure had allowed unauthorised access to the archive between 27 June and 2 July 2026. DigiCert first suspected archive access on 12 October and formally confirmed a reportable security incident on 19 October, after a forensic review of file-access records and request volumes. It filed its preliminary incident report the following day.

What data was exposed in the DigiCert breach?

DigiCert says the accessed information primarily comprised business contact details, with identity documents present for only a small minority of customer accounts. The company has not disclosed how many customers were affected, describing the compromised portion of its archive as small.

Data exposed	Who is affected
Names, business email addresses, telephone numbers, business addresses	Customers whose records were in the archived system
Passports, driver's licences, utility bills or similar identity documents	A small minority of customer accounts
Customer login credentials	Not affected, according to DigiCert
Issued certificates and certificate authority services	Not affected — no replacement needed

Image: Wikimedia Commons — a DigiCert extended validation certificate shown in Firefox

What was NOT affected — your certificates are safe

The most important point for DigiCert customers is what the breach did not touch. DigiCert says its certificate authority services, CertCentral and DigiCert ONE were unaffected, customer login credentials remain secure, and issued certificates are safe. Investigators found no certificate issuance, validation changes or revocation activity linked to the unauthorised account — so customers do not need to replace active certificates because of this incident.

That distinction matters: this was a breach of an internal business archive, not a compromise of DigiCert's certificate operations. The trust infrastructure that websites rely on for TLS/SSL was not breached.

What DigiCert's five-whys review found

DigiCert ran a five-whys root-cause analysis with its security, platform and compliance teams, and published three contributing factors in its full incident report. First, the February 2025 migration changed the system's network accessibility without a security review of the resulting attack surface — the change was treated as an infrastructure change, not a security change. Second, monitoring and alerting had never been reassessed after the migration, so there was no alert for new accounts created through the exposed endpoint or for unusual request volumes. Third, the authorisation model never contemplated self-registration: an account with no application assigned was never meant to have data access, yet it did — and the first review wrongly concluded from the missing application assignment that the account could not reach the archive.

The fixes are all marked complete in the report: the self-registration feature is deactivated, the remaining externally accessible endpoints have moved to private-IP load balancers, a single named owner now owns the system's security posture, and the permissions model has had a least-privilege review. DigiCert's own lesson: network accessibility changes to internal systems should always require a security review, and authorisation must not be delegated to a system's network position.

Why the DigiCert breach matters

DigiCert is one of the world's largest certificate authorities, issuing the TLS/SSL certificates that secure a huge share of the web. Any confirmed breach at a CA draws intense scrutiny, because a compromise of certificate operations could undermine trust across millions of websites. In this case DigiCert says that line was not crossed — but the exposure of identity documents such as passports and driver's licences is serious for the customers involved, since those documents can be misused for identity fraud.

The incident also echoes a wider pattern in 2026: misconfigurations during cloud migrations quietly exposing internal systems for months. Here the gap between the February 2025 migration and the June–July 2026 access window was more than a year — a reminder that a single migration decision can leave a system exposed long after the project is forgotten. This blog recently covered two similar long-exposure incidents: our DreamHost breach coverage showed what happens when an old weakness stays open for months, and our Zyxel GS1900 zero-day explainer showed a patch that fixed the wrong bug.

Should you care?

✅ If you are a DigiCert customer: yes — check your email for DigiCert's notification. The company says it has now contacted the affected customers with information specific to them. Watch for phishing emails using your business contact details, and monitor for identity fraud if you submitted ID documents to DigiCert. You do not need to replace any certificates.

⏳ If you only visit websites secured by DigiCert: no action is needed. DigiCert says issued certificates and its CA services were not affected, so there is nothing to do as a website visitor.

What DigiCert customers should do now

1. Check your DigiCert notification — DigiCert says it has contacted the affected customers with information specific to them, so the notification tells you exactly what of yours was accessed.
2. Stay alert for phishing — exposed business email addresses and phone numbers can be used in targeted phishing calls and emails. Treat unexpected messages claiming to be from DigiCert with suspicion.
3. Monitor for identity fraud — if you ever submitted a passport, driver's licence or utility bill to DigiCert, keep an eye on your credit reports and identity-monitoring alerts.
4. Do not revoke or replace certificates — DigiCert has confirmed this is unnecessary for this incident.
5. Report phishing attempts — if you get a suspicious message claiming to be from DigiCert, report it to DigiCert and to your national cybercrime portal (in India: cybercrime.gov.in).

FAQs

What is the DigiCert data breach?
DigiCert confirmed unauthorised access to an internal business system containing archived customer information, including identity documents for a small number of accounts. The access took place between 27 June and 2 July 2026 after a 2025 migration exposed the system to the internet, and the breach was confirmed as reportable on 19 October 2026.

Was my DigiCert certificate compromised?
No. DigiCert says its certificate authority services, CertCentral and DigiCert ONE were unaffected, no certificate issuance or revocation activity was linked to the incident, and customers do not need to replace active certificates.

What personal data was exposed in the DigiCert breach?
Names, business email addresses, telephone numbers and business addresses were exposed, and a small minority of customer accounts also had identity documents such as passports, driver's licences or utility bills exposed. DigiCert has not disclosed the number of affected customers.

How did the DigiCert breach happen?
A 4 February 2025 infrastructure migration moved the affected internal system from a VPN-restricted network segment to an externally accessible availability zone. A separate authorisation failure then allowed unauthorised access to the archive in late June and early July 2026.

Takeaway: A year-old migration mistake left DigiCert's customer archive exposed, and identity documents were caught in it — but the certificate authority itself was not compromised, so no certificates need replacing. If you are a DigiCert customer, watch for the company's notification and stay alert for phishing.

If your business ever moves an internal system during a cloud migration, this is the case study for why that change needs a security sign-off first — DigiCert's own report says exactly that. And if you received a DigiCert notification, read it carefully: it tells you precisely what of yours was exposed.

Sources

• Mozilla Bugzilla — DigiCert incident report (bug 2084460): full incident report with timeline, five-whys root cause and action items
• GBHackers — DigiCert Confirms Data Breach After Security Misconfiguration Exposes Customer Personal Information
• Cyber Security News — DigiCert Confirms Data Breach Exposing Customer Details and Sensitive Identity Documents
• Cyber Press — DigiCert Confirms Data Breach Exposing Customer Personal Information, Including IDs and Passports