DigiCert says names, business email addresses, phone numbers and business addresses of a small portion of customers were exposed, and some records also included identification documents such as a driver's license, passport or utility bill. The company is still reviewing the identification documents to determine who was affected and will notify them when the review is complete.
According to the incident report DigiCert posted on Mozilla's Bugzilla, a February 2025 server migration exposed to the internet a business system previously reachable only through VPN. The system had a self-registration feature, and an authorization flaw let external accounts read archived data. The company found unauthorized accounts in June 2026, but only on October 19 confirmed that one had accessed customer information between June 27 and July 2.
The company says the account had read-only access and could not modify records, approve validations or issue certificates. Its certificate authority services, CertCentral and DigiCert ONE were not compromised, and customer login credentials and issued certificates remain secure. DigiCert has disabled self-registration and added access controls. Customers who received a notice should be especially wary of phishing messages that use their details.