DigiCert reports data breach involving customer data and identity documents
An incorrectly exposed internal system gave unauthorised people access to part of a customer archive.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Certificate authority DigiCert has warned customers of a data breach in which contact details and some identity documents could be viewed. According to DigiCert information cited by BleepingComputer and Cyber Security News, access arose after an internal system became reachable over the internet following a migration.
The exposed data was held in an archived customer file. According to the reported notification, it included names, business email addresses, telephone numbers and company addresses. Some files could also contain documents such as driving licences, passports or energy bills showing a name and address.
According to BleepingComputer, DigiCert discovered in June that unauthorised accounts could be created on the system. The company then adjusted its access measures, but only after further investigation established that an unauthorised account had actually accessed customer data. According to the notification, that access took place between 27 June and 2 July 2026.
The certificate authority says the system provided read-only access. According to DigiCert, unauthorised people could not issue certificates, approve certificate validations or alter data. CertCentral, DigiCert ONE, customer passwords and issued certificates were also reportedly unaffected by the incident.
The number of people or files involved has not yet been made public. According to reports, DigiCert has begun informing affected customers. That leaves the scale of the incident uncertain: it is established which types of data could be viewed, but not how many customers were actually affected.
For companies using DigiCert, the misuse of business and identity data for targeted phishing or identity fraud is a possible risk. According to DigiCert, the certificates issued were not affected. DigiCert says it has disabled self-registration and introduced additional access controls.
Also show the region and a close-up
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The technical core and the types of data involved were described by two independent security publications based on DigiCert’s customer notification. The scale of the breach and actual misuse have deliberately been presented as uncertain.
- confirmed DigiCert reported a data breach in which customer data and some identity documents could be viewed. — Described by BleepingComputer and Cyber Security News. source
- confirmed The exposed system became reachable over the internet after a migration and allowed external account registration. — Circumstances according to the cited DigiCert notification. source
- confirmed The access took place between 27 June and 2 July 2026. — Date mentioned in the notification quoted by BleepingComputer. source
- confirmed Certificates, customer passwords and certificate issuance were not affected. — According to reports, DigiCert says these components were not compromised. source
- confirmed The number of affected customers has not yet been made public. — The reports give no number and say DigiCert has provided no further information on the matter. source
Editor's note
The types of data and the technical circumstances are based on DigiCert’s customer notification, as cited by multiple security media outlets. The number of affected customers and actual cases of misuse were not known.Sources
- DigiCert data breach exposes customer information, identity documents — BleepingComputer
- DigiCert Confirms Data Breach Exposing Customer Details and Sensitive Identity Documents — Cyber Security News
More on this in Dutch media
- de Volkskrant — „digicert datalek”
- NOS — „digicert datalek”
- Het Parool — „digicert datalek”