DigiCert confirms breach exposing customer identity documents
Certificate authority DigiCert confirmed unauthorized access to archived customer data. According to the company, a February 2025 infrastructure migration left an internal registration endpoint exposed to the internet, and attackers created accounts without multifactor authentication and accessed records between June 27 and July 2, 2026. DigiCert restricted access, disabled self-registration, and says certificates and credentials were not compromised.
What happened
DigiCert, a certificate authority, confirmed unauthorized access to archived customer information, including identity documents. According to the company, a February 2025 infrastructure migration left an internal registration endpoint exposed to the internet. Attackers created accounts without multifactor authentication and accessed records between June 27 and July 2, 2026.
Why it matters
Exposed data includes names, business email addresses, phone numbers, and physical addresses; a smaller number of accounts contained passports, driver's licenses, and utility bills. DigiCert states its certificate services, customer credentials, and issued certificates were not compromised. The total number of affected customers remains undisclosed.
What to do
Check whether your organization stored data or identity documents with DigiCert and follow official notifications. Advise affected staff to monitor for misuse of exposed documents.
For the technical team
- Affected
- DigiCert, autoridade de certificação digital; dados de clientes e documentos de identidade expostos · Archived data from DigiCert customer accounts. The company states certificate authority services, CertCentral, DigiCert ONE, customer credentials, and issued certificates were not compromised.
- Exploitation
- Unauthorized access between June 27 and July 2, 2026, per DigiCert. The company publicly confirmed the breach on October 19.
- Fix
- Endpoint access restricted, self-registration disabled, and additional security monitoring implemented, per DigiCert.
- Vector
- Internal registration endpoint left internet-accessible by misconfiguration during a February 2025 infrastructure migration. Attackers created accounts without multifactor authentication and obtained read-only access to archived customer records.
- More details
- Exposed data: customer names, business email addresses, phone numbers, physical addresses; smaller number of accounts with passports, driver's licenses, and utility bills. Per DigiCert, only a small portion of archived data was affected and the total number of impacted customers remains undisclosed. BleepingComputer reported the breach.
Timeline
DigiCert detailed the cause: a February 2025 infrastructure migration left an internal registration endpoint exposed to the internet, allowing account creation.
BleepingComputer reported the DigiCert breach exposing customer data and identity documents.
Sources 2 sources
- @BleepinComputer @BleepinComputer
- @DarkWebInformer @DarkWebInformer
