DigiCert says intruders saw customer ID documents in June-July breach

DigiCert has published an incident report confirming that improperly created accounts accessed stored customer data, including passport and driver's license documents, between June 27 and July 2, 2026, according to dailysecu.com.

The company found accounts that did not belong to it on its internal business system on June 18, 2026. On June 21, 2026, a vulnerability report submitted through its security research program said outside users could create accounts. DigiCert said it applied the related security measures on July 2, 2026, and later confirmed on October 19, 2026 that the accounts had in fact reached customer data.

The exposed information included customer names, work email addresses, phone numbers and company addresses. DigiCert said CertCentral, DigiCert ONE, customer login credentials and already issued certificates were not affected, and that customers do not need to revoke or reissue certificates.

In response, DigiCert has disabled external account self-registration, restricted network access to the internal system, reset user passwords and strengthened anomaly detection.

In a Bugzilla comment dated November 8, Mozilla asked DigiCert to disclose the exact scale of the breach. In February 2025, DigiCert moved an internal business system that had been reachable only through a VPN, and a misconfiguration left it accessible from the internet for more than 16 months; the company confirmed unauthorized accounts existed in June 2026 but did not initially determine whether customer data had been accessed.