DigiCert has disclosed a data breach stemming from a February 2025 server migration error that left an internal system publicly accessible, exposing customer contact details and, in some cases, passports, driver's licenses, and other identity documents.
DigiCert, one of the internet's largest certificate authorities, has disclosed a data breach in which a misconfigured server migration exposed customer names, contact details, and personal identity documents to unauthorized external access.
The breach originated from a February 2025 server migration that inadvertently made an internal business system — previously accessible only through a VPN — reachable from the public internet, according to an incident report filed on Mozilla's Bugzilla platform.
The exposed system included a self-registration feature originally intended for internal applications. An authorization flaw allowed externally created accounts to access archived customer data in read-only mode, even though those accounts were not assigned to any specific application.
DigiCert first detected unauthorized accounts on the exposed system in June 2026, but initially concluded they posed no data-access risk. The company later received an external report through its managed security research program alerting it that those accounts could, in fact, read archived customer records.
Security fixes were deployed to restrict access and close the authorization gap, but DigiCert did not confirm at that point that any data had actually been viewed. It was not until October 19 that an investigation established that an unauthorized account had accessed customer information during a window between June 27 and July 2, 2026.
"The incident was initially handled as an account-creation issue rather than a data-access event," DigiCert acknowledged in its incident report.
The company has begun sending breach notification letters to affected customers. The exposed information was limited to names, business email addresses, phone numbers, and business addresses. For a subset of customers, records also included personal identification documents — driver's licenses, passports, utility bills, or other documents bearing a name and address.
Cloud architect Fabian Bader shared a copy of the notification on X, writing: "Thanks @digicert that your data leak was 'limited' to only my full PII data and potentially any verification documents I submitted for my certificate."
DigiCert says it is still reviewing which customers had identification documents exposed and will notify those individuals separately once that review is complete.
The company said the unauthorized account carried read-only permissions and could not alter records, approve certificate validations, or issue certificates. DigiCert's core certificate authority infrastructure, its CertCentral platform, and DigiCert ONE were not affected, and customer login credentials and previously issued certificates remain secure, the company said.
In response to the incident, DigiCert has restricted access to the affected system, disabled the self-registration feature, and implemented additional access controls.
The breach underscores a recurring risk in cloud and infrastructure migration projects, where temporary or misconfigured network exposure can quietly persist for months before discovery. With identity documents — not just email addresses — among the exposed records, affected customers face an elevated risk of identity fraud that extends well beyond typical credential-based threats. DigiCert has not disclosed the total number of individuals affected.
Jay Goldberg is a staff writer at TechEchelon covering technology, markets, and policy. He files the breaking news and deal coverage that move the publication's core desks.
More from Jay →CrowdStrike launched an AI kill switch on Tuesday that lets security teams stop misbehaving internal agents, cut off their network access, and block them from relaunching — without deleting their underlying code.
Binance confirmed a $6.3 billion hack — the largest in crypto history — with investigators linking the breach to North Korea's TraderTraitor group. Around $3 billion in assets have been frozen as the exchange pledges to cover all customer losses.
Ukrainian national Artem Stryzhak was sentenced to 70 months in prison for his role as a ransomware affiliate with both the Nefilim and Hive groups, which prosecutors say caused more than $100 million in losses targeting hospitals and businesses across multiple countries.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.