The DigiCert data breach exposed names, business emails and phone numbers, and for some customers, scanned passports, driver’s licenses or utility bills. DigiCert says its certificate services and issued certificates were not touched. If you have ever bought a certificate from DigiCert, check your inbox for its notice.
The company disclosed the details on November 5, 2026. Here’s what happened, who should worry, and what to do.
Quick facts first.
- Who: DigiCert customers whose records sat in an archived internal business system.
- Exposed: names, business emails, phone numbers and addresses, plus ID documents for some accounts.
- Access window: June 27 to July 2, 2026, read-only.
- Not affected, per DigiCert: CertCentral, DigiCert ONE, customer login credentials and issued certificates.
DigiCert hasn’t said how many customers are affected, so don’t assume you’re in the clear.
What the DigiCert data breach actually exposed
Most of the viewed records held business contact details. A small number of accounts also held identity documents that customers had supplied, according to PrivacySavvy. Those include passports, driver’s licenses and utility bills showing a name and address.
DigiCert describes the affected data as a small portion of its archived customer information. It also says it is still reviewing the full extent, per Cyber Daily.
The key point: the attacker could read records, but DigiCert says the account couldn’t change them, approve identity checks or issue certificates. Its log review found no validation, issuance or revocation activity tied to that account.
How the breach happened, and why it took months
A February 2025 infrastructure migration left an internal registration endpoint reachable from the internet. Cyber Daily reports that attackers used it to get past multifactor authentication. The records in question were archived, not live certificate data, which is why DigiCert says issuing systems stayed safe.
The timeline stretches a long way, as the table shows.
| Date | What happened |
|---|---|
| February 2025 | Migration leaves the internal endpoint exposed online |
| June 18, 2026 | DigiCert notices accounts that aren’t employees; early review wrongly judges stored data unreachable |
| June 21, 2026 | A report arrives through its managed security research program |
| June 27 to July 2, 2026 | An unauthorized account views archived records |
| July 2, 2026 | DigiCert deploys an authorization fix |
| October 19, 2026 | DigiCert confirms customer data was accessed |
| November 5, 2026 | Details published in an incident report on Mozilla’s Bugzilla |
That gap between the first warning and the October confirmation is the uncomfortable part. An early review decided the data was safe, and it wasn’t.
Are your ID documents at risk?
Possibly, if you uploaded them to DigiCert for identity validation. Certificate providers sometimes need proof that a person or company is real, and that’s where passports and utility bills come in.
Names plus addresses plus ID scans are exactly what scammers use for fake government emails and account takeovers. We covered a similar case in our Revolut data breach guide, where fake official emails followed the leak.
Typical scams here look official. You might get a message saying your certificate “failed validation” or your identity must be “re-verified,” with a link to upload documents again. Don’t. Real providers won’t ask you to resend a passport through an email link, and a rushed tone is a warning sign in itself.
Treat any email, call or text that mentions DigiCert, your certificates or your documents with suspicion for the next few months.
What to do now if you use DigiCert
DigiCert hasn’t published customer steps in the coverage we reviewed, so these are our own practical suggestions. Start with these.
- Find DigiCert’s email about “a security event involving personal information” and read it.
- Log in to DigiCert by typing the address yourself, never through an email link.
- Change your password and turn on multifactor authentication, even though DigiCert says logins weren’t exposed.
- Watch for phishing that uses your name, company or certificate details.
- If a passport or license was exposed, consider a credit freeze or fraud alert and ask the issuing agency about replacement options.
Also tell colleagues. If your company bought the certificate, the person who handled validation may have uploaded documents without anyone else knowing, so ask your IT or security team who did.
The aim is simple: assume attackers know who you are, and make that knowledge hard to use.
If you manage servers, this is also a good moment to rotate other secrets. Our Northflank breach checklist shows a sensible order for doing that.
Frequently Asked Questions
Were DigiCert certificates compromised?
DigiCert says no. It says CertCentral, DigiCert ONE and issued certificates weren’t compromised, and logs show no issuance or revocation by the affected account.
Do I need to replace my SSL certificate?
Based on DigiCert’s statement, there’s no sign you must. Watch for any official guidance, and replace a certificate only if DigiCert tells you to.
How do I know if my data was involved?
DigiCert is emailing affected customers. If you’ve used DigiCert and see no message, contact its support through the official site.
Is this the same as DigiCert’s earlier breach?
No. Earlier reports in 2026 covered a separate incident involving code-signing certificates. This one concerns archived customer records and ID documents.
My take: this one is slow-burning rather than urgent. If you gave DigiCert a passport or license, lock down your accounts and expect phishing for a while. If you only bought a certificate, change your password, turn on MFA, and keep going.
Leave a Reply