DigiCert Data Exposure Playbook: What Customers Check After the Archived Data Access

DigiCert reported unauthorized read access to archived customer data following a February 2025 infrastructure migration that exposed a self-registration feature; the incident (access dated 27 June–2 July 2026) mainly exposed business contact details and a small number of identity documents. DigiCert says its CA services were not affected, disabled self-registration, moved endpoints to private addresses, reset business-system passwords, ran tests, and added monitoring; the report gives no counts or evidence of data publication. The playbook advises customers to identify what they submitted to DigiCert, warn affected representatives, maintain certificate service, review accounts and API keys, and monitor for impersonation and identity-fraud attempts.