What happened
DigiCert reported unauthorised access to an internal business system holding archived customer information. The disclosure describes business contact details and, in some cases, personal information supplied to verify customer representatives. The incident included documents such as passports, driving licences or utility bills.
What was unaffected
DigiCert says its certificate authority services, CertCentral and DigiCert ONE were unaffected. It says customer login credentials and issued certificates remained secure. The report does not establish that every DigiCert customer had identity documents exposed.
The migration lesson
The system became externally accessible following an infrastructure migration in 2025. DigiCert’s account identifies gaps in security review and monitoring. A network move can change who can reach an application even when its business purpose stays the same.
Practical takeaway — Falak83 analysis
If notified, verify the message through an established DigiCert contact and follow the guidance relevant to your documents and country. Watch for convincing impersonation attempts. Businesses should review external access after migrations and require security sign-off when a private system becomes reachable.
Avoid the wrong response
This disclosure is not, by itself, a reason to replace working DigiCert certificates.
Sources and date
Prepared for 7 November 2026. Source date: Incident report; news coverage 6 November 2026.
DigiCert incident report on Mozilla Bugzilla · Additional source / accessible report
Prepared with AI assistance. Publication requires human editorial approval.
