Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

DigiCert Data Breach Exposes Archived Customer Information

7 sources · 7 articlesFirst reported Updated ()4 · 1 read
What's new

November 6: The Record reports breach reportable to Mozilla, Google, Microsoft, Apple; exposure started June 21, 2026.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

DigiCert is notifying customers of a breach exposing archived business data accessed June-July 2026 after 2025 migration misconfiguration; certificate services unaffected.

A February 2025 server migration left an internal archive system exposed to the internet. An unauthorized external account created via self-registration without MFA accessed archived customer records from June 27 to July 2, 2026, in read-only mode. Exposed data included names, business emails, phone numbers, business addresses, and some identity documents such as driver's licenses and passports. Certificate issuance, CertCentral, credentials, and issued certificates were not affected. The company blocked the account on July 2, disabled self-registration, and is notifying affected customers while reviewing documents.

Key facts
  • 2025-02-04: Internal system migrated to externally accessible zone
  • 2026-06-27 to 2026-07-02: Unauthorized read-only access via self-registration flaw
  • Exposed fields: names, emails, phones, addresses, some IDs
  • No impact on certificate services or credentials
  • Remediation: Account blocked July 2, self-registration disabled
  • Discovery: October 2026; notifications sent November 2026
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Feb 4, 2025Infrastructure migration exposed internal system · Cyber Security News
  2. Jun 27, 2026Unauthorized access to archived customer data began · BleepingComputer
  3. Jul 2, 2026Access blocked after self-registration disabled · SecurityWeek
  4. Oct 12, 2026Suspected archived-data access identified · SecurityWeek
  5. Oct 19, 2026Breach confirmed and customer notifications began · BleepingComputer
  6. Nov 6, 2026Final auditing scheduled · GBHackers

What each outlet adds

beyond the shared facts
  • The Register16-month exposure period due to migration
  • GBHackersFinal auditing November 6, 2026; patch details
  • BleepingComputerRead-only access confirmed; no certificate issuance possible
  • DataBreaches.netNotifications reported by Lawrence Abrams and Fabian Bader on X
  • The RecordBreach reportable to Mozilla, Google, Microsoft, Apple
Vendors
DigiCert
Products
internal business system
Victims
DigiCertDigiCert customers

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Cyber Security NewsFirst report

    DigiCert Confirms Data Breach Exposing Customer Identity Documents

    DigiCert's internal system exposure exposed archived customer contact details and some identity documents; no impact on certificate services.

  2. · 6d ago GBHackers

    DigiCert confirms data breach from misconfiguration

    DigiCert confirmed unauthorized access to archived customer data after an infrastructure migration exposed a self-service registration endpoint.

  3. · 6d ago BleepingComputer

    DigiCert breach exposes archived customer data and identity documents

    An unauthorized account read archived records from June 27 to July 2, 2026, after a 2025 migration left an internal system online.

  4. · 5d ago The Register · Security

    DigiCert admits 16-month security lapse exposed customer information

    A botched server migration left customer data accessible for over 16 months.

  5. · 5d ago DataBreaches.net

    DigiCert breach exposed customer details and identity documents

    A server migration left an internal system on the internet, and DigiCert is notifying affected customers.

  6. · 5d ago SecurityWeek

    DigiCert breach exposes business customer contact data

    An exposed archive system let an attacker use a self-registered read-only account from June 27 to July 2; certificate systems were unaffected.

  7. · 5d ago The Record

    DigiCert Data Breach Exposes Customer Personal Info

    DigiCert's exposed internal system was accessed from June 2026, exposing names, emails, and IDs but not enabling cert issuance.