DigiCert has confirmed a data breach involving an internal system that stored archived customer information, including personal identification documents. The security incident resulted from an infrastructure change that unintentionally made a previously restricted application accessible over the internet.
The certificate authority said the compromised information primarily consisted of customer names, business email addresses, telephone numbers, and business addresses. A smaller number of records also contained passports, driver’s licenses, utility bills, and other documents submitted for identity verification.
DigiCert has not disclosed how many customers were affected. The company described the exposed information as a small portion of its archived records and is reviewing the documents to determine which individuals require additional notification.
The security problem originated on February 4, 2025, when DigiCert migrated an internal business application from a network accessible only through a virtual private network to a different hosting environment. The migration inadvertently exposed the application to external connections.
The affected system included a self-registration function originally intended for other applications. This allowed outsiders to create accounts without the multifactor authentication requirements imposed on DigiCert employees.
Although these newly created accounts were not assigned to an application, an authorization flaw permitted them to read archived customer records. The permissions did not allow the accounts to modify information or perform certificate-related operations.
DigiCert first noticed unauthorized accounts on June 18, 2026. However, its initial investigation incorrectly concluded that the accounts could not access sensitive information because they lacked application assignments.
The company subsequently received a security research report concerning the exposed registration functionality and introduced restrictions to address the problem.
Further investigation revealed that an unauthorized account had accessed archived customer information between June 27 and July 2, 2026. DigiCert confirmed the data exposure on October 19, several months after the activity occurred.
The company acknowledged that its initial response focused on unauthorized account creation rather than the possibility that customer information had already been accessed.
DigiCert emphasized that its certificate authority infrastructure was not compromised. Its CertCentral and DigiCert ONE platforms, customer login credentials, and previously issued digital certificates remained secure.
Investigators also found no evidence that the unauthorized account had issued, modified, or revoked certificates. Consequently, customers do not need to replace their existing certificates because of this incident.
Following the discovery, DigiCert disabled the exposed registration functionality, restricted access to the affected application, and strengthened authorization controls and security monitoring.