DigiCert Data Breach Exposes Customer Passports and Driver’s Licenses After a Server Migration Mistake

DigiCert, a major certificate authority that issues the digital certificates behind secure websites, has confirmed a data breach that exposed archived customer records, including identity documents such as passports and driver's licenses. The company says the breach started with a server migration in February 2025 that moved an internal system out from behind its virtual private network and left it reachable from the internet. Unauthorized accounts then read customer records during a six-day window in the summer of 2026, and DigiCert has now started notifying affected customers.

The incident is striking not because of a clever attack, but because of how ordinary the failure was. No new exploit was involved. A routine infrastructure change put a system that was never meant to face the public internet into a place where anyone could reach it, and the exposure sat there for more than a year before anyone noticed it had been used.

What happened, and when

According to reports from SecurityWeek, BleepingComputer and The Record, the timeline runs like this. In February 2025, DigiCert moved an internal business system during a server migration. The system had previously sat behind a VPN, which meant only people inside the company network could reach it. The migration placed it in a publicly accessible network zone, so it became reachable from the internet.

DigiCert says it detected unauthorized accounts on the system in late June 2026. An authorization flaw then let those accounts read archived customer data between June 27 and July 2, 2026. The company blocked the offending accounts and released an authorization patch on July 2, closing the access window at six days.

How a routine migration opened the door

The system involved was an internal business archive, running its own instance of an account manager platform. It held business contact details for customers, along with some personal information customers had supplied when proving their identity for certificate orders.

The Register described the episode as a 16-month security lapse, counting from the February 2025 migration to the July 2026 access window. Other reports put the exposure at almost 17 months. Either way, the system was reachable from the internet for well over a year, and the unauthorized access itself lasted only six days near the end of that period.

What data was exposed

DigiCert confirmed four categories of business contact data in the accessed records: customer names, business email addresses, phone numbers and business addresses. Most of the data, the company says, was limited to that business contact information.

The more sensitive part involves identity documents. Some records also contained documents customers had provided for identity verification, such as a driver's license, a passport, a utility bill or another document showing a name and address. DigiCert has said this applied to a small minority of accounts, and it has not confirmed that every listed document type appeared in the accessed records. It has also not said how many records held any document at all, and it has published no count of affected customers.

That gap in the numbers matters. A name and a business email address are easy to replace in a risk assessment. A passport or driver's license number is not. The company says it is still reviewing the documents to identify the people involved, and it will notify individuals after that review is complete.

What was not affected

DigiCert has been clear about the limits of the incident. No login credentials were affected, the company says, and no DigiCert-issued certificates were affected. Its certificate authority services, CertCentral and DigiCert ONE, were not affected, and the company says its log review found no validation, issuance or revocation actions tied to the unauthorized accounts. The intruder held read-only access, according to the reports, which means records were viewed rather than changed.

What DigiCert is doing now

Since the incident, DigiCert has placed the archive behind a web application firewall and blocked account creation through external access. The company has begun notifying affected customers, and it says it will notify individuals whose identity documents were involved once its review of those documents is finished. It also filed a detailed incident report on Mozilla's Bugzilla tracker, bug 2084460, as the browser root programs require.

What customers should do

If you are a DigiCert customer, the practical steps are straightforward. First, read any notification from DigiCert carefully, because it will say what data of yours was involved. If the notification mentions an identity document, treat that document as exposed and watch for identity theft.

Second, be ready for phishing. The exposed data includes names, business email addresses and phone numbers, which is exactly the material scammers use to write convincing messages. Treat unexpected emails or calls that claim to come from DigiCert, a bank or a government agency with suspicion, and verify them through a channel you trust rather than by clicking a link in the message.

Third, check your credit reports and consider a fraud alert or a credit freeze if a passport or driver's license number was involved. In the United States, you can place a fraud alert with any of the three credit bureaus, and it will be shared with the other two. A credit freeze is stronger, and it is free to place and lift.

Frequently Asked Questions

When did the DigiCert data breach happen?

Unauthorized accounts accessed an internal archive of customer records between June 27 and July 2, 2026, according to DigiCert. The system had been exposed to the internet since a server migration in February 2025. DigiCert discovered the accounts in late June 2026, finished its investigation on October 19, 2026, and began notifying customers in early November 2026.

What information was exposed in the DigiCert breach?

DigiCert says the accessed records included customer names, business email addresses, phone numbers and business addresses. In a small minority of accounts, the records also contained identity verification documents such as driver's licenses, passports or utility bills. No login credentials or DigiCert-issued certificates were affected, and the company has not published a count of affected customers.

Does the DigiCert breach affect website security certificates?

No, according to DigiCert. The company says its certificate authority services, CertCentral and DigiCert ONE, were not affected, and no certificates were issued, modified or revoked by the unauthorized accounts. The breach involved an internal business archive, not the systems that issue and manage certificates.