DigiCert Breach: Company Discloses Unauthorized Access to Business System Holding Customer Data

Further details, including the types of customer data involved, come from reports citing DigiCert’s full incident report and customer emails. DigiCert has not published those details on its own website, and thetechhacker could not independently confirm them.

Quick answer: DigiCert reported unauthorized access to a business system in its own filing on Mozilla’s bug tracker and says it affected “only a small proportion of archived data.” It hasn’t said how many customers were affected. Reports citing DigiCert say the account was read-only and that no certificates or private keys were compromised, but DigiCert has not confirmed this on its own website. Watch for phishing and tighten your DigiCert account security now.

What DigiCert has confirmed

DigiCert reported the incident itself on Mozilla’s bug tracker, where certificate authorities disclose problems to browser makers. The entry is titled “DigiCert: Unauthorized access to business system,” and DigiCert promised a full report on or before November 3, 2026.

According to that filing, accounts that weren’t assigned to any application could still see archived data on the business system. DigiCert says the incident “affected only a small proportion of archived data.”

On July 2, 2026, DigiCert deployed a fix that stopped outside account creation and blocked those accounts from the archived data. At that point, it says, it didn’t know any archived data had been accessed. That realization came later.

As of November 7, DigiCert’s status page showed no breach notice. Its only recent entry was a support chat and email outage on November 4, marked resolved. DigiCert had not published a blog post, press release or customer FAQ about the incident.

What’s been reported but not confirmed

Reports that say they’re citing DigiCert’s full report or its customer notification emails add a lot more detail. Treat all of this as reported until DigiCert publishes it somewhere you can read yourself.

• Exposed data reportedly includes names, business email addresses, phone numbers and business addresses.
• If a customer had submitted ID documents to DigiCert, driver’s licenses, passports or utility bills may also be exposed. DigiCert is reportedly still reviewing those and will notify those people once the review is done.
• The account was reportedly read-only and “could not write records, act as a validation approver, or issue certificates.”
• Certificate authority systems, CertCentral and DigiCert ONE were reportedly not affected.
• DigiCert has reportedly started emailing affected customers.

The reported timeline is long. A server migration on February 4, 2025 reportedly took the system off its VPN-protected network and left it reachable from the internet. Staff reportedly spotted unfamiliar accounts on June 18, 2026, data was accessed between June 27 and July 2, and DigiCert confirmed that access on October 19.

If that cause is right, it’s a good reminder that a routine migration can quietly undo your network protections. If you run your own servers, our piece on managed VPS hosting and security practices is worth a re-read.

Why this matters

A certificate authority breach can be serious because stolen signing keys could let attackers impersonate websites. Based on the information available so far, this incident does not appear to involve DigiCert’s certificate-issuing systems.

The bigger risk is people. A list of DigiCert customers with names, work emails and phone numbers is ideal material for convincing phishing. An email saying “Your certificate expires today, log in to renew” is an easy sell to a busy IT admin. And if ID documents really were exposed, identity theft becomes a real concern for those individuals.

What you should do now

DigiCert has not published instructions for customers, and it is not known whether it will offer credit monitoring. The steps below are general security best practices, not DigiCert’s advice:

• Be suspicious of any email, call or text claiming to be DigiCert, especially about renewals, payments or validation. Type the web address yourself instead of clicking links.
• Change your DigiCert account passwords and rotate any API keys your team uses for automation.
• Turn on multi-factor authentication (MFA, a second login step like a code from an app) for every account that can manage certificates. A password manager and an authenticator app, like the ones in our cybersecurity tools for small businesses roundup, make this much easier.
• Review your certificate inventory: which certificates you have, which domains they cover, when they expire and who can manage them. Anything you don’t recognize deserves a closer look.
• If you ever sent ID documents to DigiCert, watch for its notice and keep an eye on your credit reports.

While you’re checking certificates, make sure nothing has lapsed. An expired or missing certificate is how visitors end up seeing browser warnings like the one covered in our guide to Chrome’s HTTP “Not Secure” prompt.

What’s next

Key questions remain open. DigiCert has not disclosed how many customers were affected or whether it has notified regulators. This article will be updated when DigiCert publishes more information.

Frequently Asked Questions

Were DigiCert SSL certificates or private keys compromised?

DigiCert’s own filing describes unauthorized access to a business system holding archived data. Reports citing DigiCert say certificate authority systems weren’t affected and no certificates or private keys were compromised, but DigiCert has not confirmed this on its own website yet.

What data was exposed in the DigiCert breach, and how many customers were affected?

DigiCert hasn’t given a customer count; its filing only says the incident affected “only a small proportion of archived data.” Reportedly, exposed data includes names, business email addresses, phone numbers and business addresses, plus ID documents such as driver’s licenses, passports or utility bills for customers who had submitted them. Those details haven’t been confirmed on an official DigiCert page.

Do I need to replace my DigiCert certificates?

DigiCert has not said customers need to. Based on what’s been reported, the bigger risk is phishing, so focus on securing your account with new passwords, rotated API keys and MFA, and review your certificate inventory.