Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

DigiCert says exposed archive leaked business customer data

4 sources · 4 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

DigiCert is notifying customers after a read-only account viewed an internet-exposed archive in late June 2026; certificate issuance was unaffected.

DigiCert said a server migration left an internal archive of business-customer information exposed to the internet. An unauthorized party used self-registration without MFA to create a read-only account and viewed archived contacts from June 27 to July 2, 2026. Records included names, business emails, phone numbers, addresses and, in some cases, driver’s licenses, passports or utility bills. DigiCert says the account could not change records, approve validation or issue certificates, and that certificate systems were unaffected. Timing differs: SecurityWeek says the archive was moved in February 2025 and suspicion began October 12; The Register describes exposure of more than 16 months; The Record says external exposure started June 21 and detection was October 19. DigiCert has not said how many customers were affected and has begun notifications.

Key facts
  • Read-only access ran from June 27 to July 2, 2026, via self-registration without MFA.
  • Exposed fields included names, emails, phones, addresses and some identity documents.
  • DigiCert says the account could not issue certificates or change records.
  • Customer count is undisclosed; breach notifications have begun.
  • SecurityWeek cites October 12 suspicion; The Record cites October 19 detection.
  • DigiCert disabled self-registration, reset passwords and removed non-DigiCert accounts.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Jun 21, 2026The Record says the internal system was exposed externally. · The Record
  2. Jun 27, 2026Unauthorized read-only access to the archive began. · SecurityWeek
  3. Jul 2, 2026DigiCert blocked the account and ended the exposure. · SecurityWeek
  4. Oct 12, 2026DigiCert began suspecting archived-data access. · SecurityWeek
  5. Oct 19, 2026The Record says DigiCert detected the incident. · The Record

What each outlet adds

beyond the shared facts
  • SecurityWeekFebruary 2025 move, October 12 suspicion, and later account cleanup.
  • The RecordJune 21 exposure start, October 19 detection, and browser-vendor reporting.
  • DataBreaches.netUtility bills among documents and a notification copy posted on X.
  • The RegisterFrames the exposure as lasting more than 16 months.
Vendors
DigiCert
Victims
DigiCert

Coverage

oldest first · one row per article · UTC
  1. · 6d ago The Register · SecurityFirst report

    DigiCert admits 16-month security lapse exposed customer information

    A botched server migration left customer data accessible for over 16 months.

  2. · 6d ago DataBreaches.net

    DigiCert breach exposed customer details and identity documents

    A server migration left an internal system on the internet, and DigiCert is notifying affected customers.

  3. · 6d ago SecurityWeek

    DigiCert breach exposes business customer contact data

    An exposed archive system let an attacker use a self-registered read-only account from June 27 to July 2; certificate systems were unaffected.

  4. · 6d ago The Record

    DigiCert Data Breach Exposes Customer Personal Info

    DigiCert's exposed internal system was accessed from June 2026, exposing names, emails, and IDs but not enabling cert issuance.