DigiCert says a server mistake let an unauthorized account read archived customer data, including some passports and driver's licenses.
DigiCert, a company that verifies businesses and websites so people can trust them online, has warned customers about a data breach. A mistake during a server move left an internal system open to the internet. Someone used it to read archived customer records. For some people, those records included copies of passports and driver's licenses.
According to an incident report DigiCert filed on Mozilla's Bugzilla platform, a February 2025 server migration exposed an internal business system that had previously been reachable only through a VPN, a private connection. The system let outsiders create their own accounts. Those accounts were not tied to any application, but a flaw in its permissions still let them view archived customer information in read-only mode.
DigiCert found unauthorized accounts on the system in June 2026. It first concluded they could not reach customer data. Then a security researcher reported that outsiders could create accounts. DigiCert fixed the access problem but did not realize archived data had been viewed. On October 19, a deeper investigation confirmed an unauthorized account had accessed customer information between June 27 and July 2, 2026.
DigiCert says a small portion of its archived customer data was affected. The notice sent to customers lists:
DigiCert is still reviewing identification documents to work out who was affected. It says it will notify those people when that review is done. A cloud architect, Fabian Bader, posted a copy of his notice on X.
The unauthorized account could only read data. DigiCert says it could not change records, approve certificate validations or issue certificates. The company also says its certificate authority services, CertCentral and DigiCert ONE were not compromised, and that customer login credentials and issued certificates remain secure. If you only use DigiCert certificates and never sent in personal documents, your exposure looks smaller.
The steps in the alert box above cover the practical moves. The main risk is that criminals now hold real names, work emails and phone numbers. That makes convincing phishing messages easier to write. Anyone who sent an ID has a higher identity fraud risk.
DigiCert has not said how many people were affected. BleepingComputer has asked the company that question and others, and says it will update its story if it gets a reply. DigiCert has also not yet told everyone whether their ID documents were among the records viewed, so some customers are still waiting for that answer.
If you ever gave DigiCert business details or an ID, watch for its notice and treat any message about your account with suspicion.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
