DigiCert Breach Exposes Customer Identity Documents for 16 Months

DigiCert confirmed a security breach that exposed customer contact records and personal identification documents after an internal archival business system was accidentally exposed to the open internet for over 16 months. The lapse began on February 4, 2025, during an infrastructure migration.

A permissions flaw allowed external users to register accounts without multifactor authentication, granting them read-only access to archived files. While the majority of the exposed data consisted of business contact information, a small minority of files contained sensitive identity verification documents, including passports, driver's licenses, and utility bills.

The company identified non-company accounts on June 18, 2026, and deployed an authorization fix on July 2, 2026. DigiCert later confirmed that unauthorized data access had occurred on October 19, 2026. The company noted that the incident was initially handled as an account-creation issue rather than a data-access event.

DigiCert stated that its core certificate authority services, issued certificates, and customer login credentials were not affected by the breach.