DigiCert is one of the companies that makes the internet's padlock icon mean something. It issues the digital certificates that prove a website is really who it says it is. In November 2026, DigiCert confirmed that an outsider got into its own archived customer records. That included passports, driver's licenses, and utility bills some customers had submitted for identity verification. The company that verifies trust online had its own trust problem.
What actually happened
The root cause traces back to a server migration in February 2025. That migration left an internal system reachable without a VPN. No login beyond the open network was needed. DigiCert staff first noticed outside accounts on the system on June 18, 2026. At the time, staff concluded those accounts couldn't reach any real data. The accounts weren't assigned to an application, so it seemed safe. That conclusion was wrong. Those outside accounts read archived customer data between June 27 and July 2, 2026. A deeper investigation, finished October 19, confirmed the exposure.
DigiCert says its core certificate services were not affected. That includes CertCentral and DigiCert ONE. The exposure was limited to an archive of older customer records. The company has since turned off self-signup on that system. It also tightened who can log in.
What was exposed
Names, business email addresses, phone numbers, and business addresses were part of the exposure. Some records also included personal ID documents: passports, driver's licenses, and utility bills. That's the paperwork companies collect to verify who you are, used before issuing a certificate or approving an account.
DigiCert has not said how many people were affected. The company is still reviewing which exact documents were involved. It's sending notifications as it confirms each one.
Why a verification company getting breached is worse than most
Most breaches expose data a company collected for its own purposes. This one is different. DigiCert's identity documents existed specifically to prove the people submitting them were real. Often that was part of getting a business verified online. A real passport scan paired with real business details is a strong base for building a convincing fake identity somewhere else. That's the same risk this site has flagged with the IDScan.net and Revolut breaches earlier this year.
- Watch for a notification email from DigiCert. They're sending these as they confirm which documents were involved, not all at once.
- Freeze your credit if you submitted ID documents to them. Free at Equifax, Experian, and TransUnion. It blocks the most common use of a stolen passport or license: opening new credit in your name.
- Be extra wary of identity-verification requests that reference your real documents. A scammer with your actual passport number can sound very convincing while asking you to "re-verify" somewhere else.
- Check whether your business, not just you personally, submitted documents to DigiCert. This breach touched business accounts. A company owner's personal ID may be exposed through a business relationship they'd forgotten about.
Was your email tied to this breach or any other?
Our free scan shows which known breaches contain your email and whether identity data was exposed alongside it.
Run the Free Breach Scan →