Updated November 7, 2026
DigiCert data breach
| Company | DigiCert, Inc., a certificate authority that issues website security (SSL/TLS) and code signing certificates |
|---|---|
| Access window | June 27 to July 2, 2026 |
| Discovered | October 12, 2026 (suspected), confirmed October 19, 2026 |
| Data exposed | Names, business email addresses, phone numbers and business addresses. For a small minority of accounts, a driver’s license, passport, utility bill or similar document. |
| People affected | Not disclosed. No state attorney general filing found as of November 6. |
| Not affected | Certificates, certificate issuance, CertCentral, DigiCert ONE and customer login credentials, per DigiCert |
| Lawsuit | None found as of November 6, 2026 |
DigiCert says an outsider accessed archived customer records for six days this summer, exposing business contact details and, for some customers, copies of driver’s licenses, passports or utility bills, according to the company’s incident report to browser makers. BleepingComputer reported the breach on November 5, 2026, and customers have started receiving notice emails.
DigiCert says the access was read only and could not issue or change certificates. It has not said how many people were affected. It told browser makers “to our knowledge, there is no evidence of misuse” and reported the incident to law enforcement, according to The Record. The Register reports DigiCert’s email to affected people says it is still reviewing ID documents to identify individuals and will notify them when done.
Key takeaways
- An unauthorized account read archived DigiCert customer data between June 27 and July 2, 2026.
- Most records held business contact details. Some included ID documents such as passports and driver’s licenses.
- DigiCert only confirmed the data access on October 19, 2026, more than three months later.
- DigiCert says it will notify people whose ID documents were involved after it finishes reviewing them.
What happened in the DigiCert breach
In its report, DigiCert wrote: “DigiCert identified an event involving unauthorized access to an internal business system which is used to archive information provided by customers.” It said “most of the data was limited to business contact information for customers: names, business email addresses, phone numbers, and business addresses. A small minority of customer accounts included additional personal data in the form of a customer-provided document such as a driver’s license, passport, utility bill, or other document with name and address.”
DigiCert traced the problem to a February 4, 2025 infrastructure change that moved the system out of a VPN-only network and made it reachable from the internet. A self-registration feature let outside accounts sign up without multifactor authentication, and those accounts could read archived data. DigiCert staff noticed outside accounts on June 18, 2026 but at first treated it as an account creation issue, and a researcher raised the issue about three days later, according to The Register. A patch on July 2 ended the data access, but DigiCert did not suspect data was read until October 12 and confirmed it October 19.
Key dates
- February 4, 2025: System migration exposes the archive system to the internet.
- June 27 to July 2, 2026: Unauthorized data access.
- October 12, 2026: DigiCert first suspects data was accessed.
- October 17, 2026: Password resets for all users of the system.
- October 19, 2026: DigiCert confirms the data access.
- November 1, 2026: DigiCert publishes its full incident report.
- November 5, 2026: Breach reported publicly as customer emails go out.
Is this the same as DigiCert’s April 2026 incident?
No. In April 2026, attackers compromised DigiCert support machines and obtained code signing certificates, which DigiCert revoked, according to Help Net Security. DigiCert’s November report does not list that event as related.
What DigiCert customers should do
- Watch for phishing emails that use your name, company and DigiCert account details, especially ones about certificate renewals or payments.
- If you uploaded a passport or driver’s license to DigiCert for identity validation, consider a free credit freeze with the three credit bureaus.
- Watch for a separate notice from DigiCert if your ID document was involved. It should say what was exposed and whether monitoring is offered.
How do I join a DigiCert data breach lawsuit?
No lawsuit has been filed. If DigiCert sends individual notices about exposed ID documents, data breach suits often follow. People who receive a notice are usually included in any class automatically. Our guide on how to join a class action lawsuit explains the process, and you can see current examples in our Kelly Benefits data breach settlement coverage.
Frequently asked questions
Was DigiCert hacked?
DigiCert says an unauthorized party accessed an internal archive system between June 27 and July 2, 2026.
Are my DigiCert certificates safe?
DigiCert says its certificate services, CertCentral and DigiCert ONE were not affected and that issued certificates remain valid and trusted.
How many people were affected by the DigiCert breach?
DigiCert has not released a number. It says the incident affected only a small proportion of archived data.
Is DigiCert offering credit monitoring?
We have not seen an offer yet. We will update this story if DigiCert announces one.
This article is for general information and is not legal advice. DigiCert’s review is ongoing, and we will update this story as more details are released.
