DigiCert Data Breach Impacts Business Customer Information

According to SecurityWeek, DigiCert has disclosed a data breach impacting its business customers' contact information, including names and email addresses.[2]SecurityWeek reports that the system was moved to a different network segment in February 2025, inadvertently becoming exposed to the internet.[2] The outlet says attackers used a self-registration feature that did not require MFA to create a read-only account that had access to archived data between June 27 and July 2.[2]BleepingComputer quotes the notification as saying the exposed data "may have included an identification document such as a driver's license, passport, utility bill or other document"[3].According to teiss, DigiCert said staff noticed non-DigiCert accounts on the system on June 18, 2026[4]. The company initially handled the problem as an account-creation issue, not a data-access event.[4]BleepingComputer reports that DigiCert says its certificate authority services, CertCentral, and DigiCert ONE platforms were not compromised[3]. According to teiss, DigiCert said customers do not need to replace active certificates.[4]SecurityWeek says DigiCert did not say how many customers might have been affected.[2] The Register reports that DigiCert told affected customers it is "completing a review of identification documents to determine the specific individuals involved."[1]According to SC Media, DigiCert has since disabled the self-registration feature and implemented stricter access controls[5].