DigiCert suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents, according to a recent report by Bleeping Computer.
The certificate authority confirmed that the incident occurred after a February 2025 server migration left an internal system accessible without a virtual private network. This system contained a self-registration feature that allowed external users to create accounts. An authorization flaw subsequently permitted these accounts to access archived customer data in read-only mode between June 27 and July 2, 2026. Exposed information included names, business email addresses, phone numbers and business addresses. In some instances, personal identification documents such as passports, driver’s licenses and utility bills were also accessed. DigiCert discovered the unauthorized accounts in June 2026 but initially misclassified the event as a minor account-creation issue. A deeper investigation concluded on October 19 confirmed that data had been compromised. The company stated that its core services, including CertCentral and DigiCert ONE, remain secure and were not affected by the breach. DigiCert has since disabled the self-registration feature and implemented stricter access controls to prevent future unauthorized entry. The company is currently notifying affected customers and reviewing identification documents to determine the full scope of the exposure.
Source: Bleeping Computer
