DigiCert, one of the web's major certificate authorities, warns that it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to archived customer information.

The exposed records contained names, business email addresses, phone numbers, and business addresses, and for a small portion of customers also identification documents such as driver's licenses, passports, and utility bills.

DigiCert has begun sending breach notifications to affected customers and says it is still reviewing identification documents to determine everyone affected.

The exposure began on February 4, 2025, when a migration moved the system from a VPN-restricted network segment into an externally accessible availability zone without a security review.

A self-registration feature intended for other applications became reachable, and although self-registered accounts had no application assigned, an authorization flaw gave them read-only access to archived customer data.

Unlike DigiCert staff accounts, these accounts did not require multi-factor authentication. The stated lesson, per DigiCert's incident report, is that internal tools need explicit authorization checks even when network restrictions are expected to protect them.

The timeline shows repeated missed signals. DigiCert's team noticed non-DigiCert accounts on June 18, 2026, but incorrectly concluded that accounts without an assigned application could not access data, according to Cyber Press's account of the report.

A managed security research program reported external account creation on June 21, and an authorization fix shipped July 2.

Investigators later established that an unauthorized account read customer information between June 27 and July 2, 2026, but DigiCert acknowledged it initially handled the incident as an account-creation issue rather than a data-access event, confirming the reportable breach only on October 19 after forensic review of file-access records.

The consequences are unusually narrow for a certificate authority breach: DigiCert says its certificate authority services, CertCentral, and DigiCert ONE platforms were not compromised, that customer login credentials and issued certificates remain secure, and that customers do not need to replace active certificates.

Investigators found no certificate issuance, validation changes, or revocation activity linked to the unauthorized account.

The real risk falls on identity documents — passports and driver's licenses are prime material for identity fraud and convincing phishing, and the exposed business contact details of certificate holders could enable targeted social engineering against security teams.

DigiCert has disabled self-registration across business-system instances, moved remaining exposed endpoints behind private-IP load balancers, reset business system passwords, and strengthened monitoring, per the company's incident report.

A subsequent access control review confirmed each subsystem endpoint now checks application assignment and role, and new application-level file-access and request-volume alerts were added on October 15.

BleepingComputer reports it has contacted DigiCert to ask how many people were impacted, a figure the company has not disclosed, and notifications to individuals whose identity documents were affected will follow once the review is complete.