DigiCert Confirms Data Breach After Security Misconfiguration Exposes Customer Personal Information

DigiCert confirmed that a migration misconfiguration exposed an internal archived-customer-data system and an inherited self-service registration endpoint, permitting creation of accounts that bypassed MFA and had default read permissions. Investigators determined unauthorized access occurred from June 27 to July 2, 2026, exposing names, business contact information and, for a small subset of accounts, identity documents (passports, driver’s licenses, utility bills); certificate issuance and CA services were not impacted. Remediation actions included disabling self-registration, moving endpoints behind private-IP load balancers, resetting business-system passwords, deploying an authorization patch, and adding file-access alerts.