DigiCert warns of breach exposing customer data and identity documents
DigiCert warns that a server migration mistakenly exposed an internal business system to the internet.
Written by a model from the sources below. Verify against them.
- Vendor
- DigiCert
- Status
- Reported, not confirmed
- Disclosed
- Data taken
- Names, Email addresses, Phone numbers, Government IDs
- BleepingComputer: “Although these accounts weren't assigned to any particular application, an authorization flaw let them access archived customer information in read-only mode.”
- Exploited vulnerability
Summary
It says this allowed unauthorized access to customer information and identity documents.
What to do
Watch for accounts or loans opened with your ID or passport, and ask the office that issued it whether to replace it
For Government IDs (some people)Expect phishing that uses this breach; verify messages that mention it
For email addresses and phone numbersCheck whether you submitted identity documents or other personal data to DigiCert and review what it holds.
Monitor accounts and identity records for suspicious activity.
Follow DigiCert's official notices for affected-customer guidance.
Timeline
- Attackers got in
BleepingComputer: “It wasn't until October 19 that a further investigation confirmed an unauthorized account had accessed customer information between June 27 and July 2, 2026.”
5 days · attackers inside - Attackers' access ended126 days
- Made public by BleepingComputer
- First seen by cve.now1 day
- Record last updated
What was taken
| Taken | Per the source |
|---|---|
| Names, Email addresses, Phone numbers | BleepingComputer: “The certificate authority says the breach affected a small portion of its archived customer data, including names, business email addresses, phone numbers, and…” |
| Government IDs (some people) | BleepingComputer: “For some people, the exposed records also contained personal identification documents, such as driver's licenses, passports, and utility bills.” |
Evidence 9
- Social
- SocialBluesky
“DigiCert breach leaks archived customer data and identity docs; active certificates untouched.”
- PressBleepingComputer
“DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents.”
+1 more: BleepingComputer on Bluesky - SocialBluesky
“BleepingComputer reported on November 5 that a server migration mistake exposed an internal DigiCert business system to the internet, allowing unauthorized access.”
- SocialMastodon
“DigiCert's recent data breach left customers reeling after archived records and sensitive identity documents were mistakenly exposed to the internet, thanks to a server migration gone wrong.”
Show all 9 sourcesShow fewer sources
- SocialMastodon
“Verify whether your organization received a DigiCert breach notification and confirm MFA is enforced on all DigiCert accounts now, not after the next migration.”
- SocialMastodon
“DigiCert says an internal archive was accessed June 27–July 2 after a server migration exposed a business system.”
- SocialBluesky
“#DigiCert breached - contact details including customers' passports & driver's licenses leaked:”
- SocialMastodon
“DigiCert breach: a server migration left an internal business system reachable from the internet.”
Corrections
- Changed “Names were exposed” to “Names of small portion of its archived customer data were exposed”.
- Changed “Email addresses were exposed” to “Email addresses of small portion of its archived customer data were exposed”.
- Changed “Phone numbers were exposed” to “Phone numbers of small portion of its archived customer data were exposed”.
- Changed “Names of small portion of its archived customer data were exposed” to “Names were exposed”.
- Changed “Email addresses of small portion of its archived customer data were exposed” to “Email addresses were exposed”.
- Changed “Phone numbers of small portion of its archived customer data were exposed” to “Phone numbers were exposed”.
- Changed “Names were exposed” to “Names of small portion of archived customer data were exposed”.
- Changed “Email addresses were exposed” to “Email addresses of small portion of archived customer data were exposed”.
- Changed “Phone numbers were exposed” to “Phone numbers of small portion of archived customer data were exposed”.
- Changed “Names of small portion of archived customer data were exposed” to “Names were exposed”.
- Changed “Email addresses of small portion of archived customer data were exposed” to “Email addresses were exposed”.
- Changed “Phone numbers of small portion of archived customer data were exposed” to “Phone numbers were exposed”.
- Changed “Names were exposed” to “Names of small portion of archived customer data were exposed”.
- Changed “Email addresses were exposed” to “Email addresses of small portion of archived customer data were exposed”.
- Changed “Phone numbers were exposed” to “Phone numbers of small portion of archived customer data were exposed”.
- Changed “Names of small portion of archived customer data were exposed” to “Names of a small portion of its archived customer data were exposed”.
- Changed “Email addresses of small portion of archived customer data were exposed” to “Email addresses of a small portion of its archived customer data were exposed”.
- Changed “Phone numbers of small portion of archived customer data were exposed” to “Phone numbers of a small portion of its archived customer data were exposed”.
- Changed “Names of a small portion of its archived customer data were exposed” to “Names of archived customer data were exposed”.
- Changed “Email addresses of a small portion of its archived customer data were exposed” to “Email addresses of archived customer data were exposed”.
- Changed “Phone numbers of a small portion of its archived customer data were exposed” to “Phone numbers of archived customer data were exposed”.
- Changed “Names of archived customer data were exposed” to “Names were exposed”.
- Changed “Email addresses of archived customer data were exposed” to “Email addresses were exposed”.
- Changed “Phone numbers of archived customer data were exposed” to “Phone numbers were exposed”.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the DigiCert breach
Was DigiCert breached?
BleepingComputer reports it. No statement from DigiCert has reached cve.now yet.
What data was exposed?
Names, Email addresses, Phone numbers, Government IDs (some people).
What should DigiCert customers do?
Watch for accounts or loans opened with your ID or passport, and ask the office that issued it whether to replace it. Expect phishing that uses this breach; verify messages that mention it. Check whether you submitted identity documents or other personal data to DigiCert and review what it holds. Monitor accounts and identity records for suspicious activity. Follow DigiCert's official notices for affected-customer guidance.