By Hamza Faisal
Certificate authority DigiCert has disclosed a data breach that exposed business customers' contact information — and, in some cases, copies of passports and driver's licences — after a server migration accidentally left an internal archive system reachable from the internet.
The company, whose certificates secure websites and software around the world, said the breach did not touch its certificate-issuing systems. No certificates were issued by the intruder, no customer login credentials were taken, and its CertCentral and DigiCert ONE platforms were not affected.
But the incident is an uncomfortable one for a company whose entire business is trust. The exposed system held archived customer records, including identity documents submitted during certificate verification — the very paperwork meant to prove who a customer is.
A migration that quietly opened a door
According to DigiCert's disclosure, the internal business system used to archive customer information was moved to a different network segment in February 2025. The move inadvertently exposed it to the internet, where it had previously sat behind a virtual private network.
Attackers took advantage of a self-registration feature in the system's account manager — one built for other purposes and not protected by multi-factor authentication — to create a read-only account. That account accessed archived data between June 27 and July 2, 2026.
DigiCert blocked the unauthorized account on July 2. It was not until October, however, that the company determined the account had actually reached archived customer contact information, and on October 19 it confirmed the incident was a reportable event. Customer notifications began in early November.
What was exposed
The data accessed included customer names, business email addresses, phone numbers and business addresses. In some cases it also included identity documents customers had provided, such as driver's licences, passports and utility bills used to validate an organisation's identity.
DigiCert has not said how many customers were affected. A spokesperson said there was no evidence the information had been misused, and the company has reported the incident to law enforcement. It declined to say whether the attackers had contacted it.
"The access could not write records, act as a validation approver, or issue certificates," DigiCert said in its disclosure. "The CA systems operate on their own secure network segments and were not affected by this external access."
A lapse measured in months, not days
The company published a post-mortem on Mozilla's Bugzilla tracker, as required by the root-store programmes run by Mozilla, Google Chrome, Microsoft and Apple, which set the rules certificate authorities must follow.
DigiCert attributed the delayed detection to the migration being treated as an infrastructure change rather than a security change, and to insufficient alerting on new account creation and request volume.
The exposure window itself ran for more than a year — from the February 2025 migration until the unauthorized account was blocked in July 2026 — although DigiCert says the only confirmed access to archived data took place during the six days in late June and early July.
For customers, the practical advice is familiar: watch for phishing attempts using the exposed contact details, and treat any unexpected message claiming to come from DigiCert with suspicion. The company says affected customers have been notified directly.
