# SZB-58fbd93471: DigiCert warns of breach exposing customer data and identity documents

DigiCert warns that a server migration mistakenly exposed an internal business system to the internet.

- Type: Breach
- Status: Reported, not confirmed
- Vendor: DigiCert
- Disclosed: 2026-11-05 06:59 UTC
- Data taken: Names, Email addresses, Phone numbers, Government IDs
- Way in: Exploited vulnerability (BleepingComputer: “Although these accounts weren't assigned to any particular application, an authorization flaw let them access archived customer information in read-only mode.”, [source](https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/))
- Sources: 10 distinct
- First seen by cve.now: 2026-11-05 07:00 UTC · Updated: 2026-11-06 02:25 UTC

> No statement or filing from DigiCert has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

It says this allowed unauthorized access to customer information and identity documents.

## What to do

- Watch for accounts or loans opened with your ID or passport, and ask the office that issued it whether to replace it · For Government IDs (some people)
- Expect phishing that uses this breach; verify messages that mention it · For email addresses (small portion of archived customer data) and phone numbers (small portion of archived customer data)
- Check whether you submitted identity documents or other personal data to DigiCert and review what it holds.
- Monitor accounts and identity records for suspicious activity.
- Follow DigiCert's official notices for affected-customer guidance.

## Timeline

- 2026-06-27: Attackers got in. BleepingComputer: “It wasn't until October 19 that a further investigation confirmed an unauthorized account had accessed customer information between June 27 and July 2, 2026.” ([source](https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/))
- 2026-07-02: Attackers' access ended
- 2026-11-05 06:59 UTC: Made public by BleepingComputer
- 2026-11-05 07:00 UTC: First seen by cve.now
- 2026-11-06 02:25 UTC: Record last updated
- Attackers inside for 5 days (2026-06-27 to 2026-07-02)

## What was taken

- Names (small portion of archived customer data), Email addresses (small portion of archived customer data), Phone numbers (small portion of archived customer data): [BleepingComputer](https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/): “The certificate authority says the breach affected a small portion of its archived customer data, including names, business email addresses, phone numbers, and business addresses.”
- Government IDs (some people): [BleepingComputer](https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/): “For some people, the exposed records also contained personal identification documents, such as driver's licenses, passports, and utility bills.”

## Evidence (10 sources)

- 2026-11-05 · Social · [Bluesky](https://bsky.app/profile/infosec.skyfleet.blue/post/evnbokjqwy4pu): “DigiCert Confirms Data Breach Exposing Customer Details and Sensitive Identity Documents” (+17 more: [Bluesky](https://bsky.app/profile/hapsis.bsky.social/post/3mzkcd2dxfk2m), [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzkkwjmpnv24), [Bluesky](https://bsky.app/profile/bloggersminds.com/post/3mzlbc6mcjs2c), [Bluesky](https://bsky.app/profile/infosec.skyfleet.blue/post/jmj2gd55hfiv7), [Bluesky](https://bsky.app/profile/e-kiledjian.bsky.social/post/3mzld6n7ctf2l), [Bluesky](https://bsky.app/profile/abijita.bsky.social/post/3mzle6etul62q), [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzle6yndyd2d), [Bluesky](https://bsky.app/profile/cybernewsph.com/post/3mzlfsrauqa22), [Bluesky](https://bsky.app/profile/packetstorm.bsky.social/post/3mzlomhfzbw2a), [Bluesky](https://bsky.app/profile/tccubed.com/post/3mzlpkqegrm2w), [Bluesky](https://bsky.app/profile/hapsis.bsky.social/post/3mzm2i2b4bs22), [Bluesky](https://bsky.app/profile/edwing.mstdn.moimeme.ca/post/3mzm3z7nviao2), [Bluesky](https://bsky.app/profile/newssecia.bsky.social/post/3mzm5x2q6j22w), [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzm6wygxll23), [Bluesky](https://bsky.app/profile/sambowne.infosec.exchange.ap.brid.gy/post/3mzmatdkraur2), [Bluesky](https://bsky.app/profile/securityonline.bsky.social/post/3mzmcppzijh2y), [Bluesky](https://bsky.app/profile/ninjaowl.ai/post/3mzmd6dh5ad2u))
- 2026-11-05 · Social · [Bluesky](https://bsky.app/profile/thedailytechfeed.com/post/3mzko32dwtu2s): “DigiCert breach leaks archived customer data and identity docs; active certificates untouched.”
- 2026-11-05 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/): “DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzlb4tq32v2p))
- 2026-11-05 · Social · [Bluesky](https://bsky.app/profile/malice.ai/post/3mzlbkopkobh2): “BleepingComputer reported on November 5 that a server migration mistake exposed an internal DigiCert business system to the internet, allowing unauthorized access.”
- 2026-11-05 · Social · [Mastodon](https://mastodon.social/@Analyst207/117564757805703490): “DigiCert's recent data breach left customers reeling after archived records and sensitive identity documents were mistakenly exposed to the internet, thanks to a server migration gone wrong.”
- 2026-11-05 · Social · [Mastodon](https://infosec.exchange/@security_crawler_carl/117565067304460834): “Verify whether your organization received a DigiCert breach notification and confirm MFA is enforced on all DigiCert accounts now, not after the next migration.”
- 2026-11-05 · Social · [Mastodon](https://infosec.exchange/@cyberseckyle/117565137193519148): “DigiCert says an internal archive was accessed June 27–July 2 after a server migration exposed a business system.”
- 2026-11-05 · Social · [Bluesky](https://bsky.app/profile/securestep9.bsky.social/post/3mzljygple22z): “#DigiCert breached - contact details including customers' passports & driver's licenses leaked:”
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@cloud/117566742098030587): “DigiCert breach: a server migration left an internal business system reachable from the internet.”
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@DailyCyberSecurity/117567079906102745): “A DigiCert data exposure revealed customer records and IDs after an internal business system breach.”

## Corrections

- 2026-11-05: Changed “Names were exposed” to “Names of small portion of its archived customer data were exposed”.
- 2026-11-05: Changed “Email addresses were exposed” to “Email addresses of small portion of its archived customer data were exposed”.
- 2026-11-05: Changed “Phone numbers were exposed” to “Phone numbers of small portion of its archived customer data were exposed”.
- 2026-11-05: Changed “Names of small portion of its archived customer data were exposed” to “Names were exposed”.
- 2026-11-05: Changed “Email addresses of small portion of its archived customer data were exposed” to “Email addresses were exposed”.
- 2026-11-05: Changed “Phone numbers of small portion of its archived customer data were exposed” to “Phone numbers were exposed”.
- 2026-11-05: Changed “Names were exposed” to “Names of small portion of archived customer data were exposed”.
- 2026-11-05: Changed “Email addresses were exposed” to “Email addresses of small portion of archived customer data were exposed”.
- 2026-11-05: Changed “Phone numbers were exposed” to “Phone numbers of small portion of archived customer data were exposed”.
- 2026-11-05: Changed “Names of small portion of archived customer data were exposed” to “Names were exposed”.
- 2026-11-05: Changed “Email addresses of small portion of archived customer data were exposed” to “Email addresses were exposed”.
- 2026-11-05: Changed “Phone numbers of small portion of archived customer data were exposed” to “Phone numbers were exposed”.
- 2026-11-05: Changed “Names were exposed” to “Names of small portion of archived customer data were exposed”.
- 2026-11-05: Changed “Email addresses were exposed” to “Email addresses of small portion of archived customer data were exposed”.
- 2026-11-05: Changed “Phone numbers were exposed” to “Phone numbers of small portion of archived customer data were exposed”.
- 2026-11-05: Changed “Names of small portion of archived customer data were exposed” to “Names of a small portion of its archived customer data were exposed”.
- 2026-11-05: Changed “Email addresses of small portion of archived customer data were exposed” to “Email addresses of a small portion of its archived customer data were exposed”.
- 2026-11-05: Changed “Phone numbers of small portion of archived customer data were exposed” to “Phone numbers of a small portion of its archived customer data were exposed”.
- 2026-11-05: Changed “Names of a small portion of its archived customer data were exposed” to “Names of archived customer data were exposed”.
- 2026-11-05: Changed “Email addresses of a small portion of its archived customer data were exposed” to “Email addresses of archived customer data were exposed”.
- 2026-11-05: Changed “Phone numbers of a small portion of its archived customer data were exposed” to “Phone numbers of archived customer data were exposed”.
- 2026-11-05: Changed “Names of archived customer data were exposed” to “Names were exposed”.
- 2026-11-05: Changed “Email addresses of archived customer data were exposed” to “Email addresses were exposed”.
- 2026-11-05: Changed “Phone numbers of archived customer data were exposed” to “Phone numbers were exposed”.
- 2026-11-06: Changed “Names were exposed” to “Names of small portion of archived customer data were exposed”.
- 2026-11-06: Changed “Email addresses were exposed” to “Email addresses of small portion of archived customer data were exposed”.
- 2026-11-06: Changed “Phone numbers were exposed” to “Phone numbers of small portion of archived customer data were exposed”.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-58fbd93471&body=https%3A%2F%2Fcve.now%2FSZB-58fbd93471%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the DigiCert breach

### Was DigiCert breached?

BleepingComputer reports it. No statement from DigiCert has reached cve.now yet.

### What data was exposed?

Names (small portion of archived customer data), Email addresses (small portion of archived customer data), Phone numbers (small portion of archived customer data), Government IDs (some people).

### What should DigiCert customers do?

Watch for accounts or loans opened with your ID or passport, and ask the office that issued it whether to replace it. Expect phishing that uses this breach; verify messages that mention it. Check whether you submitted identity documents or other personal data to DigiCert and review what it holds. Monitor accounts and identity records for suspicious activity. Follow DigiCert's official notices for affected-customer guidance.

## Related

- Started as early warning SZB-58fbd93471, first seen 2026-11-05 07:00 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-58fbd93471
Site guide for agents: https://cve.now/llms.txt