DigiCert data breach exposes customer information, identity documents

DigiCert disclosed a data breach resulting from a misconfigured server migration in February 2025 that inadvertently exposed an internal business system to the internet. The system, which had a self-registration feature, allowed unauthorized external users to create accounts and, due to an authorization flaw, gain read-only access to archived customer information. Between June 27 and July 2, 2026, an unauthorized account accessed sensitive customer data including names, business email addresses, phone numbers, business addresses, and in some cases, identity documents such as driver's licenses, passports, and utility bills.

AI-extracted · verify before operational use