DigiCert recently confirmed a security breach involving one of its internal systems, which compromised sensitive customer information. The breach resulted in unauthorized access to archived data, including names, business email addresses, phone numbers, and business addresses, along with some identity documents.
Extent of the Data Breach
While the breach affected only a small fraction of DigiCert’s archived data, some customers’ accounts contained additional sensitive documents, such as passports and driver’s licenses. The company disclosed the breach on October 19, 2026, and issued a preliminary report the next day. However, no specific numbers regarding the affected individuals or organizations were provided.
Importantly, DigiCert’s core services, including its Certificate Authority operations, CertCentral, and DigiCert ONE, were not impacted. The company assured that customer login credentials and issued certificates remained secure and that there was no evidence of unauthorized changes to certificate issuance or validation.
Investigation and Response Measures
The breach originated from an infrastructure change on February 4, 2025, when DigiCert migrated its business system to a new network zone, inadvertently making it accessible from the internet. This shift exposed an account registration feature, bypassing the multi-factor authentication required for staff accounts, leading to unauthorized access.
Upon identifying non-DigiCert accounts on June 18, 2026, the company initially underestimated the access risk due to an error in assessing application assignments. Although further registrations were blocked, existing unauthorized access remained until an authorization fix was implemented on July 2.
Lessons Learned and Future Actions
DigiCert’s investigation concluded that unauthorized access occurred over a short period from June 27 to July 2. The breach was initially misclassified as an account-creation issue rather than a data-access problem. In response, the company has taken several corrective actions, including disabling self-registration, enhancing network security, and reinforcing monitoring protocols.
The incident highlights the need for explicit authorization checks within internal tools, even when network restrictions are presumed to be adequate. DigiCert’s efforts to rectify the situation include completing a comprehensive permissions review and instituting stricter security approvals for network changes.
In summary, while this breach did not affect certificate operations, it underscores the importance of robust security measures and vigilant monitoring to prevent unauthorized data access.
