DigiCert Data Breach Exposes Business Customer Information to Unauthorized Access
A recent data breach at DigiCert, a leading digital certificate authority, has left business customers’ sensitive information vulnerable to unauthorized access. The incident, which occurred in June and July of this year, compromised contact information for an undisclosed number of customers, including names, email addresses, phone numbers, and business addresses.
The breach involved an internal business system used by DigiCert for archiving customer data, which was mistakenly exposed to the internet after being moved to a different network segment in February 2025. Attackers exploited a self-registration feature in the system’s account manager, which did not require multi-factor authentication (MFA), to create a read-only account that granted access to archived data between June 27 and July 2.
DigiCert detected the unauthorized account on July 2, but it wasn’t until October that they realized the extent of the damage. An investigation revealed that the attackers had accessed archived customer contact information, including sensitive documents such as driver’s licenses, passports, utility bills, and other personal identification documents.
The company emphasizes that the breach did not affect their Certificate Authority (CA) systems, which operate on secure network segments and were not impacted by the external access. However, the incident highlights the importance of robust security measures, particularly in internal business systems handling sensitive customer data.
DigiCert’s response to the breach has been swift, with the company implementing additional monitoring and alerting measures since mid-October. They have also reset passwords for all business system users, deactivated the self-registration feature, and verified the ownership of the affected system and enforced permission policies.
While DigiCert remains tight-lipped about the exact number of customers affected by the breach, it’s clear that businesses relying on their services need to be vigilant in monitoring their accounts and sensitive information. This incident serves as a reminder for organizations to regularly review and update their security protocols, ensuring that internal systems handling customer data are protected from unauthorized access.
As we navigate an increasingly complex threat landscape, it’s essential for companies like DigiCert to prioritize robust security measures and transparency when addressing data breaches. Businesses relying on their services would do well to scrutinize their own security posture and take proactive steps to safeguard sensitive information from potential threats.
Source: SecurityWeek — 2026-11-06