One of the world’s largest certificate authorities has confirmed a security incident of its own. The DigiCert data breach, disclosed on November 5, 2026, exposed archived customer information after a misconfiguration left an internal business system reachable from the internet for more than a year. DigiCert says its certificate authority services were not affected, and customer login credentials and issued certificates remain secure, but the incident is a reminder that even the companies that secure the internet can be undone by a routine infrastructure change. Here is what happened, what was exposed, and what customers should do now.
DigiCert Data Breach: What Happened
DigiCert confirmed unauthorized access to an internal business system that held archived customer information. The company published a full incident report in Mozilla’s public certificate authority compliance tracker on November 1, 2026, and the story was first widely reported on November 5.
The problem started with an infrastructure migration on February 4, 2025. During that migration, DigiCert moved the business system from a network segment restricted to VPN traffic into an externally accessible availability zone. That single change exposed the system to the internet. Worse, the system included a self service registration feature that was meant for other implementations. Once the system was reachable from outside, anyone could create an account on it.
Those self registered accounts did not need multi factor authentication, which DigiCert’s own staff accounts require. They also had no application assigned to them, which should have meant they could not access anything. Instead, an authorization gap gave them read only access to the archived customer data. The accounts could view records, but they could not modify them, approve identity checks, or issue certificates.
DigiCert’s own team noticed non DigiCert accounts on the system on June 18, 2026. An initial review concluded, incorrectly, that accounts without an application assignment could not access data. A report from the company’s managed security research program followed on June 21, and engineers confirmed the registration problem on June 24. By then it was already too late. Investigators later established that unauthorized access to the archived records took place between June 27 and July 2, 2026.
DigiCert deployed an authorization patch on July 2 that rejected accounts without application assignments, and on July 9 it restricted the system hostnames to VPN traffic except for approved external endpoints. But the company did not suspect that archived data had actually been read until October 12. After a forensic review of file access records and request volumes, it confirmed a reportable breach on October 19, 2026, and filed a preliminary report the next day.
What Data Was Exposed
The accessed archive held customer contact information: names, business email addresses, telephone numbers and business addresses. For a small minority of accounts, the archive also contained identity documents that customers had provided during validation, including passports, driver’s licenses and utility bills.
DigiCert describes the affected portion of its archive as small, but it has not published a count of affected people, organizations or documents. The company says it is still reviewing the identity documents to identify everyone affected and will notify individuals once that review is complete. The report does not say the data was published or sold anywhere.
What Was Not Affected
This is the part DigiCert customers will care about most. The company’s certificate authority services were not affected. That includes CertCentral and DigiCert ONE, the platforms customers use to manage certificates. Customer login credentials were not exposed, and issued certificates remain valid and trusted.
Investigators found no certificate issuance, validation or revocation activity tied to the unauthorized account. The access was read only, so the attacker could view records but could not issue a certificate, approve an identity check or change any data. Customers do not need to replace their active certificates because of this incident.
That distinction matters, because a breach of certificate operations would have been far more serious than a breach of an internal business archive. It is also different from an earlier DigiCert support system breach involving code signing certificates, and from a 2024 DNS validation error that required certificate replacements.
How DigiCert Responded
DigiCert says it has already fixed the immediate problems. Self registration is disabled, the remaining exposed endpoints have been moved back behind private network infrastructure, and business system passwords have been reset. The company has also added a security sign off rule for network changes, run a penetration test, and set up new alerts on file access and request volumes.
Two items were still in progress when the report was published: a final exposure audit and a review of automated account alerts. Both were scheduled for completion on November 6, 2026. DigiCert has not said how affected customers will be notified individually, so customers who sent DigiCert identity documents should assume they could be in scope until the company says otherwise. You can read the full independent reporting on the incident here: https://cyberpress.org/digicert-confirms-data-breach/
What Customers Should Do Now
If your organization uses DigiCert, start by finding out what you sent the company. Ask whoever manages your DigiCert account which representatives gave a name, business email, phone number or address, and check whether anyone uploaded a passport, driver’s license or utility bill during validation. Anyone named in those records should be warned that their contact details may have been exposed, and they should watch for phishing emails that use their real name, job title or company details.
You do not need to replace your certificates or reset your DigiCert login password because of this incident, since the company says credentials and certificates were not affected. But this is a good moment for routine hygiene anyway: review who has access to your certificate accounts, remove accounts belonging to people who have left, and make sure multi factor authentication is turned on everywhere it is available.
The wider lesson is one that security teams already know but keep relearning. A single network change can undo years of careful access control, and a wrong triage call can turn a small exposure into a months long incident. DigiCert’s own report is unusually detailed, and it is worth reading carefully if you run internal systems, because the failure chain will look familiar. A practical checklist for customers is available here: https://brandefense.io/security-news/digicert-breach-what-customers-should-check/
Why This Breach Matters
DigiCert is one of the biggest names in internet security, and that is exactly why this story matters. The breach was not caused by a sophisticated zero day exploit or a nation state attack. It was caused by a migration, a registration feature left switched on, and an authorization check that did not work the way people assumed it did. Those are ordinary mistakes, and they happen in companies of every size.
The incident also shows the value of transparency. DigiCert published a detailed report, admitted the wrong triage call in June, and listed what was still unfinished, which helps the whole industry learn from the failure instead of guessing at it. For everyone else, the takeaway is simple: audit your own network changes, test your authorization rules with real accounts, and never assume that an account without permissions cannot read your data.
FAQs
What happened in the DigiCert data breach?
DigiCert confirmed unauthorized access to an internal business system holding archived customer information. A misconfiguration in February 2025 exposed the system to the internet, and unauthorized access to the records took place between June 27 and July 2, 2026. The breach was confirmed on October 19, 2026.
What information was exposed in the DigiCert breach?
Mostly names, business email addresses, telephone numbers and business addresses. A small minority of accounts also had identity documents exposed, including passports, driver’s licenses and utility bills. DigiCert has not published a count of affected people or organizations.
Were DigiCert certificates affected?
No. DigiCert says its certificate authority services, CertCentral and DigiCert ONE, were not affected. Customer login credentials and issued certificates remain secure, and customers do not need to replace active certificates.
How did the DigiCert breach happen?
An infrastructure migration on February 4, 2025 moved an internal business system from a VPN restricted network segment to an externally accessible availability zone. A self service registration feature became reachable from the internet, and accounts created through it received read only access to archived data because of an authorization gap.
When did DigiCert discover the breach?
Staff noticed non DigiCert accounts on the system on June 18, 2026, but an initial review wrongly concluded they could not access data. DigiCert first suspected archive access on October 12 and confirmed a reportable breach on October 19, 2026.
Should DigiCert customers do anything?
Customers should check which representatives and identity documents they gave DigiCert, warn anyone whose details may have been exposed, and watch for phishing. No certificate replacement or password reset is required because of this incident, but reviewing account access and enabling multi factor authentication is good practice.
Was the stolen data published or sold?
DigiCert’s report does not say the data was published or sold. The company says it is still reviewing the identity documents to identify everyone affected and will notify individuals once that review is complete.
2 Responses