DigiCert Breach Exposes Archived Customer Data After Internal System Migration

DigiCert disclosed unauthorized access to an internal business system containing archived customer contact information and, in some cases, personal identification documents. A February 2025 server migration inadvertently exposed the previously VPN-restricted system to the internet. An unintended self-registration feature and an authorization flaw allowed unauthorized accounts without MFA or application assignments to read archived records. DigiCert identified customer data access between June 27 and July 2, 2026; the number of affected customers was not disclosed.

DigiCert discovered unauthorized accounts in June but initially classified the activity as an account-creation issue, confirming a reportable data-access incident on October 19. The company restricted network access, disabled self-registration, fixed authorization controls, enhanced monitoring, and began notifying affected customers. DigiCert says its certificate authority services, CertCentral, DigiCert ONE, customer login credentials, and issued certificates were not compromised. The incident highlights the need to validate external exposure and application-level authorization after infrastructure migrations, rather than treating unauthorized registration as an isolated issue.