DigiCert notifies customers of breach exposing identity records

DigiCert has begun notifying customers that unauthorized access to an internal business system exposed archived contact information and, for some people, identification documents. The certificate authority says the affected records included names, business email addresses, phone numbers and business addresses; some also contained passports, driver's licenses or utility bills. A February 2025 migration exposed the system to the internet. Self-registration and an authorization flaw allowed outsiders to access archived records. DigiCert confirmed on October 19 that an unauthorized account accessed customer information between June 27 and July 2, 2026. Its review of identification documents continues. DigiCert says the access could not modify records, approve validations or issue certificates.