DigiCert Confirms Data Breach Exposing Customer Personal Information, Including IDs and Passports

DigiCert confirmed unauthorized external access to a small, archived portion of an internal business system containing customer names, business contact information and, for a minority of accounts, identity documents (driver’s licenses, passports, utility bills). The exposure resulted from an infrastructure migration that exposed a self-service registration endpoint and a separate authorization failure; access occurred June 27–July 2, was detected internally in June but only confirmed as a reportable breach after forensic review in October. Remediation included token validation, disabling self-registration, password resets, moving endpoints behind private networks, and adding file-access and request-volume alerts; certificate issuance and customer credentials were reported unaffected.