An intruder read ID documents entrusted to DigiCert, the company that certifies websites

On June 18, 2026, a DigiCert team spotted accounts on one of the company's internal systems that did not belong to any of its employees. It concluded that these accounts could not read anything and simply blocked their creation. That was a mistake. On October 19, the US certificate authority determined that an intruder had in fact viewed customer data. For a minority of customers, this could include identity documents.

DigiCert issues certificates, the files that let your browser verify it is talking to the intended website. To issue some of them, it checks the identity of the customer company's representatives, backed by supporting documents. It is the archive of this information that was exposed. The company reported the incident on October 20 on Mozilla's tracking site, where certificate authorities report their incidents to browser vendors, then detailed it in early November. Several specialized outlets, including BleepingComputer, picked it up on November 5.

A server moved out of the VPN without a security review

It all started with a routine operation. On February 4, 2025, during an infrastructure migration, the system moved from a network segment reserved for VPN connections to a zone reachable from the Internet. A self-service registration feature, intended for other uses, became accessible to anyone. The accounts created this way did not require two-factor authentication. Because of a flaw in permission management, they could read the archived data, in read-only mode. DigiCert acknowledges that the migration was treated as a simple infrastructure project, with no security review.

On June 21, 2026, a report received through its security research program alerted the company: outsiders could create an account. The fix was not deployed until July 2. In the meantime, from June 27 to July 2, an unauthorized account viewed customer information. DigiCert states it plainly: the incident was first handled “as an account creation problem rather than as access to data.”

Passports and driver's licenses for a minority of customers

Most records contain only business contact details: business name, email address and phone number, and company address. For a small minority of accounts, according to DigiCert, the archive also contained the documents provided during verification: driver's license, passport, utility bill or any other proof of name and address. The company says only “a small portion” of the archived data is affected, without giving any figure. On November 5, a participant in the Mozilla discussion thread asked it for those figures. No answer had appeared at the time of writing.

DigiCert stresses one point: the account could not modify records, validate a request or issue a certificate. According to the company, its CertCentral and DigiCert ONE platforms were not affected, and customer credentials and issued certificates remain safe. Notifications to affected people have begun: cloud architect Fabian Bader posted a copy on X, according to BleepingComputer.

DigiCert customers: precautions to take

This was no sophisticated hack: a server moved out of the VPN and a registration form left open were enough. For customers, the main risk is targeted phishing. A scammer who knows the name and phone number of your certificate administrator can impersonate DigiCert very convincingly.

• Be wary of messages that mention an urgent renewal, a new identity check or a change of bank details. Use your usual console, never a link you received.
• If you provided an ID document during a validation, read DigiCert's notification carefully and stay alert to any attempt at identity theft.
• For your own teams: a network migration is also a security change. Since August 28, 2026, DigiCert has required a security review for this type of operation.

One question remains open: how many people, and from which countries, had their documents exposed? DigiCert says it is still reviewing the identity documents to determine whom to notify. Browsers keep certificate authorities under close watch: in October, Chrome stopped trusting certain eMudhra certificates over other failings.