DigiCert data breach: customer IDs exposed by a server move

The company that vouches for your website's identity leaked some of its customers' identities. The DigiCert data breach exposed archived customer records, including names, business emails, phone numbers and addresses. For some customers, it also exposed the passports, driver's licenses and utility bills they sent in to get a certificate validated. The cause wasn't an advanced attack. A server move in February 2025 left an internal system open to the internet, and nobody noticed for over a year.

What actually happened

DigiCert explained the incident in a post-mortem on Mozilla's Bugzilla, as BleepingComputer and The Record report:

• The mistake. A February 2025 migration moved an internal business system out of its VPN-only network. The system had a self-registration feature, so outsiders could create accounts.
• The flaw. The new accounts weren't assigned to any application. An authorization bug still let them read archived customer data.
• The miss. DigiCert found unknown accounts in June 2026 and decided they couldn't reach data. It shipped a fix by July 2. Only on October 19 did it confirm that an outside account read customer records from June 27 to July 2. In DigiCert's own words, it treated the event "as an account-creation issue rather than a data-access event."
• What's safe. DigiCert says the account was read-only. It couldn't approve validations or issue certificates. CA services, CertCentral, DigiCert ONE, customer logins and issued certificates were not affected.
• What's unknown. DigiCert hasn't said how many customers were affected. It is still reviewing ID documents to find out whose were exposed.

DigiCert told The Record it has seen no misuse and has reported the incident to law enforcement.

Why the DigiCert breach matters for your business

Your certificates are fine. The risk is phishing that sounds real. An attacker who knows your name, your business address and that you buy certificates from DigiCert can write a very believable "your certificate is about to expire, re-verify now" email.

What we'd do this week:

1. Did you get a DigiCert notice? If an ID document was included, treat it as exposed. Watch for identity fraud attempts against the person whose ID it was.
2. Re-verify nothing from email. Log in to CertCentral by typing the URL. Never use a link in a message.
3. Tell your team. Whoever handles renewals should know this phishing angle exists.
4. Learn the real lesson. DigiCert's own report says the migration "was treated as an infrastructure change rather than a security change." Every time you move a server, ask: what can reach this now that couldn't before?

Sources: BleepingComputer, The Record.