Teollimi

DigiCert data breach

Was I affected?

DigiCert confirmed a breach affecting an undisclosed number of people, exposing names, email addresses, phone numbers and addresses. You may be affected if you or your company bought certificates from DigiCert and you supplied contact details or an ID document for validation, especially if you received a DigiCert breach notice in November 2026.

DigiCert breach facts
AnnouncedOct 21, 2026
When it happenedJune 27 – July 2, 2026
CountrySeveral countries
Data exposedNames, Email addresses, Phone numbers, Addresses, Driver's license numbers and Passport numbers
StatusConfirmed by the company or a regulator filing

What happened

Certificate authority DigiCert disclosed that an internal business system used to archive customer-supplied validation information was accidentally exposed to the internet after a February 2025 server migration, and that an outside account accessed part of the archived data between June 27 and July 2, 2026. DigiCert confirmed the access on October 19 and reported it on Mozilla's Bugzilla on October 21; notification emails to customers followed in early November. The data includes names, business email addresses, phone numbers and business addresses, and for some people identity documents such as driver's licenses, passports or utility bills. DigiCert says certificate issuance, CertCentral, DigiCert ONE and customer login credentials were not affected, and it has not said how many people were involved.

What should I do?

  1. If DigiCert tells you an ID document was involved, watch for identity fraud: check your credit reports and, in the US, consider a free credit freeze.
  2. If a passport or driver's license was exposed, ask the issuing agency whether you can report it or get a replacement with a new number.
  3. Be wary of emails about certificate renewals or validation that ask you to log in or upload documents; go to your DigiCert account directly.
XRedditWhatsApp

Check the other services you use →

Sources