DigiCert confirms breach exposing archived customer contact details and identity documents
- Severity
- High
- Sources
- 1
What happened
DigiCert disclosed unauthorised read-only access to an archived-data internal business system. A February 4, 2025 migration moved the system out of a VPN-restricted segment into an availability zone where it became internet-accessible without review, and a self-registration feature created accounts outside MFA coverage with read access to archived records. Unauthorised access ran June 27 to July 2, 2026, with the registration fix released July 2; the activity was first suspected October 12 and confirmed October 19, 2026. No CVEs are cited. Defenders should note the stated absence of certificate issuance, validation or revocation activity, which means active certificates need not be replaced. Self-registration has been disabled, endpoints moved behind private networking, passwords reset and permissions reviewed.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Customers do not need to replace active certificates because of this incident.
- Watch for a notification from DigiCert, which says it will contact affected individuals once its review of identity documents is complete.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies
Products