--- title: "DigiCert: customer data and ID documents exposed by a server migration" description: "DigiCert is notifying some of its customers after an internal system, exposed to the internet by mistake, allowed access to archived data and identity documents. Certificates are not affected, but the information could be used for targeted phishing." canonical: https://inyourgeek.com/en/articles/2026-11-05-digicert-donnees-clients-et-pieces-d-identite-exposees-par type: article author: "Sébastien Soulier" publisher: "InYourGeek" language: en datePublished: 2026-11-05 dateModified: 2026-11-05 section: "Security" tags: ["digicert", "fuite", "certificats", "identite"] --- # DigiCert: customer data and ID documents exposed by a server migration > DigiCert is notifying some of its customers after an internal system, exposed to the internet by mistake, allowed access to archived data and identity documents. Certificates are not affected, but the information could be used for targeted phishing. November 5, 2026 · Security · 3 min ## An internal system exposed since February 2025 DigiCert, a certificate authority, has begun sending data breach notifications to some of its customers. [BleepingComputer](https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/) reported the news on 5 November 2026. One of the recipients posted a copy of the letter on X. DigiCert explains how the incident began in a report filed on Bugzilla, Mozilla's bug-tracking platform. In February 2025, a server migration exposed an internal business system to the internet. Until then, it had been reachable only through a VPN. The system had a self-registration feature, intended for other applications, that let outside users create an account. Those accounts were not linked to any application. Even so, a flaw in permission handling gave them read-only access to archived customer data. ## An incident first handled as an account problem In June 2026, DigiCert spotted unauthorised accounts on the system. At the time, the company concluded that they could not view customer data, since they were not associated with any application. A report then came in through its security research programme saying that outsiders could create accounts. DigiCert rolled out fixes to restrict access and correct the authorisation flaw. At that point, it did not establish that any archived data had been viewed. On 19 October 2026, a further investigation confirmed that an unauthorised account had in fact accessed customer information between 27 June and 2 July 2026. DigiCert acknowledges this in its report: "The incident was initially handled as an account-creation issue rather than a data-access event." More than three months therefore passed between the access and its confirmation. ## What was viewed, and what was not According to the notification, the information involved is limited to the names, business email addresses, phone numbers and business addresses supplied to DigiCert. Where a customer had provided one, a supporting document may also have been exposed: a driving licence, passport, utility bill or other document showing a name and address. DigiCert says only a small portion of its archived customer data is affected. It has not disclosed how many people are affected, and BleepingComputer has asked the company. The review of identity documents is still under way. Those affected will be told once it is complete. The unauthorised account had read access only. It could not modify records, approve certificate validations or issue certificates. DigiCert states that its certificate authority services and its CertCentral and DigiCert ONE platforms were not compromised. According to the company, customer login credentials and issued certificates remain secure. DigiCert has restricted access to the system, disabled self-registration and added access controls. ## What customers can check If you have had an identity or an organisation validated by DigiCert, first check whether you have received the notification. Watch for a possible second letter about identity documents, since that review is not finished. A name, a business email address, a business phone number and an address are enough to write a targeted, convincing message. If an email or call claims to come from DigiCert, mentions this incident or refers to a certificate validation, verify it through your usual channels. Do not use the links or phone numbers it contains. If your file included a passport or driving licence, follow the steps your country sets out for an exposed identity document. The certificates themselves were not affected. What was viewed were the documents supplied to obtain them. ## Sources - [DigiCert data breach exposes customer information, identity documents](https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/) — bleepingcomputer.com _Article written with AI assistance from the cited sources, reviewed and approved by a human before publication._ --- Equivalent HTML page : https://inyourgeek.com/en/articles/2026-11-05-digicert-donnees-clients-et-pieces-d-identite-exposees-par Published by InYourGeek — https://inyourgeek.com/en/a-propos Method and safeguards : https://inyourgeek.com/en/methode All articles : https://inyourgeek.com/en/archives