Internet security firm DigiCert has reported a data breach involving an internal business system that was inadvertently exposed to external access. The incident, which began in February 2025, was confirmed by the company on October 19, 2026, and has raised concerns regarding the security of customer information.
DigiCert, a prominent certificate authority based in Utah, disclosed that the breach occurred after an internal system was moved outside of a VPN-restricted network, making it accessible to unauthorized users. The company noted that it became aware of the exposure on June 21, 2026, when it discovered that an unassigned account had been created on the system. The issue was rectified by July 2, 2026.
Details of the Breach
According to DigiCert, the database was accessed starting June 27, 2026, and the compromised data included customer names, business email addresses, phone numbers, and sensitive documents such as driver’s licenses and utility bills. However, the company has not disclosed the number of affected customers. A spokesperson stated that there is currently no evidence of misuse of the accessed information and that the incident has been reported to law enforcement for further investigation.
Despite the breach, DigiCert emphasized that its core certificate authority services were not impacted, and customer login credentials were not compromised. The company reassured customers that the threat actors who accessed the database could not issue certificates or perform other critical actions.
Response and Implications
The breach has sparked alarm on social media, with users sharing breach notification emails from DigiCert and expressing concerns about the potential for threat actors to link personal documents to specific certificates. DigiCert acknowledged that the incident was classified as a “reportable event” under guidelines established by major tech companies, including Mozilla, Google, Microsoft, and Apple.
The company attributed the delayed detection of the breach to a misclassification of the system migration as an infrastructure change rather than a security change, which would have warranted a more thorough review. DigiCert also noted that the business system lacked adequate alerting mechanisms for new account creation and unusual request volumes.
As the investigation continues, DigiCert is focused on providing relevant information to its customers regarding the incident. The company’s proactive approach in reporting the breach and cooperating with law enforcement reflects its commitment to transparency and customer security.
For further details, see the full report on The Record.
