MicrosoftAvailable
SC-900
Certificate Authority DigiCert Reports Data Breach
DigiCert reported that an internal business system was exposed and accessed by an outsider. Customer contact details and ID documents were involved, but DigiCert says certificate issuance was not affected.
Short answer: DigiCert says an internal business system was reachable from the internet and its database was accessed starting June 27. Exposed data included names, business emails, phone numbers and documents like passports. DigiCert says the attackers could not issue certificates and login credentials were not taken.
DigiCert says an internal business system was exposed to the internet and that someone outside the company accessed its database. The data included customer names, business email addresses, phone numbers and documents such as driver's licenses, passports and utility bills. DigiCert says its certificate authority services were not affected, according to The Record.
What happened at DigiCert
The Utah-based company posted a long post-mortem on Mozilla's Bugzilla platform. It says the incident began in February 2025, when an internal business system was moved out of a VPN-restricted network. That made the system reachable from outside.
DigiCert wrote: "Beginning on 2026-06-21, DigiCert determined that the business system was externally accessible when that was not intended, and that an unassigned account had been created." The company said the issue was fixed by July 2.
On October 19, DigiCert confirmed the database was accessed starting on June 27. It called the incident a "reportable event."
Why it went unnoticed
DigiCert gave two reasons. The migration "was treated as an infrastructure change rather than a security change which would have triggered more detailed review and sign off." Also, the system had "insufficient alerting for new account creation through the externally-accessible endpoint or request volume from its internal endpoints."
Who is affected and what was exposed
This is a business customer data incident. If you received a breach notification email from DigiCert, treat yourself as affected. The report does not say how many customers were impacted. Here is what DigiCert reported.
Item | Status per DigiCert |
|---|---|
Customer names | Accessed |
Business email addresses | Accessed |
Phone numbers | Accessed |
Driver's licenses, passports, utility bills and other info | Accessed |
Certificate issuance by the attackers | Not possible |
Certificate authority services | Not affected |
Customer login credentials | Not taken |
No product versions are involved, so there is nothing to patch on your side.
How serious it is and whether it was exploited
The data was accessed, so this is a confirmed breach, not just an exposure. A DigiCert spokesperson said: "To our knowledge, there is no evidence of misuse of the information involved. We have reported the incident to law enforcement and will continue to support the investigation as needed." The spokesperson declined to say whether the attackers have contacted DigiCert.
The incident was reportable because of rules issued by Mozilla, Google Chrome, Microsoft and Apple. DigiCert says the threat actors could not issue certificates or take other actions.
The main risk is identity and social engineering. Several people on social media worried that attackers could tie personal documents like IDs and passports to specific certificates. That is a fair concern for phishing. An attacker with your name, phone number and a document you submitted to DigiCert, such as a passport or utility bill, can sound very convincing on a call about a certificate order.
The investigation is ongoing, so check your DigiCert notification email and the Bugzilla post-mortem for updates.
What to do now
Nothing here needs an emergency change. None of these steps require downtime.
Verify the email. Open your DigiCert account by typing the address yourself. Do not click links in the notification.
List what you uploaded. Find which documents you submitted to DigiCert, such as staff passports or utility bills. Tell those people their documents may have been involved.
Check what was issued for your domains. Compare Certificate Transparency logs against your own records.
Restrict who can issue. Publish a CAA record so only your chosen CAs can issue.
Tighten the account anyway. Credentials were not taken, but enable MFA and review user lists for accounts you do not recognize.
Warn your staff. Tell staff to treat calls or emails about "your DigiCert order" with suspicion and call back on a known number.
This query lists certificates logged since June 1, 2026 for your domain. Replace example.com with yours.
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[] | select(.not_before > "2026-06-01") | [.not_before, .issuer_name, .common_name] | @tsv' | sort -uThis shows which CAs your DNS currently allows.
dig +short CAA example.comThis shows the issuer and validity dates of the certificate your server presents.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -issuer -datesWorked example
Say your company has three domains and you submitted an admin's passport to DigiCert. You run the crt.sh query and find a certificate you did not request. Revoke it with the issuing CA and report it. If every entry matches your records, the exposed passport is still a phishing risk, but your certificates are not.
What IT and security learners can take from it
This breach was not a clever exploit. A system moved from a VPN network to an exposed one, and the move was handled as routine infrastructure work with no security review and no alert on new accounts. Change management, asset inventory and logging are what security exams test, and this case shows why. Our CAS-005 exam guide covers these topics at the advanced level. If you want more on how CA trust decisions play out, read our post on the Cisco eMudhra emergency distrust.
If you are building a security study path, browse our cybersecurity certifications.
Sources
Questions about this topic
Can attackers issue certificates in my name because of this breach?
DigiCert says the threat actors who accessed the database could not issue certificates or take other actions. To be safe, search Certificate Transparency logs for your domains. A CAA record also limits which CAs may issue for you.
Do I need to replace my existing DigiCert certificates?
DigiCert says its certificate authority services were not affected and customer login credentials were not taken. Follow any instruction in your notification email. A Certificate Transparency check will show whether anything unexpected was issued.
How do I know a DigiCert breach email is genuine?
Do not use links in the email. Type the DigiCert account address into your browser and check for the same notice there. Several people shared these notification emails on social media, so scammers may copy the format.
Why did DigiCert report this to browser makers?
DigiCert said the incident was reportable under rules issued by Mozilla, Google Chrome, Microsoft and Apple. The post-mortem was published on Mozilla's Bugzilla platform.
What is a CAA record and does it help here?
A CAA record is a DNS entry that lists which certificate authorities may issue certificates for your domain. It does not undo the exposure of your documents. It does narrow the options for anyone trying to get a certificate for your domain.
