DigiCert says an internal system holding archived customer records and identity documents was reachable by unauthorized users
November 5, 2026 (Unauthorized access in summer 2026; confirmed October 19; disclosed November 5, 2026)
According to a November 5 report on DigiCert's disclosure, the certificate provider confirmed unauthorized access to an internal business system that held archived customer data. The records include names, business email addresses, phone numbers and business addresses, and for a small minority of accounts also passports, driver's licenses, utility bills or other documents showing a name and address. DigiCert has not said how many people or organizations are affected. The report puts the access between June 27 and July 2, 2026, says DigiCert confirmed it on October 19 and filed a preliminary incident report the next day. It says a February 2025 infrastructure migration moved the system out of a network segment restricted by VPN, which left it reachable from the internet without a security review. A self-registration feature then let new accounts, which were not subject to the multi-factor authentication required of staff, read archived information because of a gap in permission checks. DigiCert says its certificate authority services, CertCentral and DigiCert ONE were not affected, that investigators found no certificate issued, validated or revoked in connection with the unauthorized account, and that customers do not need to replace active certificates. It has disabled self-registration, moved remaining exposed endpoints behind private network infrastructure, reset business system passwords, completed a permissions review and now requires security approval for network access changes. It is reviewing the identity documents to find affected individuals and plans to notify them.
Why it matters
Identity documents are hard to replace, and the cause was an ordinary change: a migration quietly left a system reachable from the internet. DigiCert's statement that certificate services were untouched matters because website trust rests on them, but the figures on affected people are still missing.
What defenders can take from it
- DigiCert customers: expect a notice if your documents were involved, and watch for phishing that uses your company details or documents submitted for validation.
- Anyone whose passport or driver's license details were exposed: watch for attempts to open accounts or reset credentials in your name.
- Organizations: after any migration, re-check what is reachable from the internet, require multi-factor authentication for every kind of account including self-registered ones, and delete archived data you no longer need.