{"id":"CMP-202611-dlpxxo","kind":"campaign","aliases":[],"related":[],"title":"DigiCert breached: exposed internal archive leaked customer contact details and some passports, driver's licences and utility bills","description":null,"summary":"DigiCert, the certificate authority, confirmed that an internal business system holding archived customer validation data was reachable from the internet after a 4 Feb 2025 migration. A self-service sign-up endpoint created accounts without MFA that could read archived records; outsiders read data between 27 Jun and 2 Jul 2026. DigiCert confirmed it on 19 Oct 2026 and customers got notices by 4 Nov. Exposed: names, business emails, phone numbers and business addresses, plus passports, driver's licences, utility bills or other name-and-address documents for a small minority of accounts. The number of affected customers is unknown. DigiCert says CertCentral, DigiCert ONE, CA issuance, customer logins and issued certificates were not affected, and no certificates need replacing.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DigiCert","fixed":[],"ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Check whether your organisation, or the people who did DigiCert identity/organisation validation, received a DigiCert breach notice email (sent from about 4 Nov 2026)\n- List which staff gave DigiCert contact details or ID documents for OV/EV validation","fix":"- No certificate rotation or password change needed per DigiCert\n- Warn the staff named as DigiCert contacts to expect targeted phishing that uses their name, role and the DigiCert relationship (fake renewal, validation or 'reissue' emails)\n- If ID documents were shared, follow the notice for identity-theft protection and watch for document misuse","status":"open","published_at":null,"first_seen_at":"2026-11-05T16:35:10+00:00","triaged_at":"2026-11-05T16:35:10+00:00","updated_at":"2026-11-05T16:35:38+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':20A '19':84B '2':77B '2025':51B '2026':79B,86B '27':74B '4':49B,92B 'account':62B,122B 'address':102B,115B 'affect':126B,144B 'archiv':5A,38B,68B 'author':30B 'bill':18A,109B 'breach':2A 'busi':35B,96B,101B 'ca':135B 'campaign':23B 'certcentr':132B 'certif':29B,141B,147B 'cmp':19A 'confirm':31B,81B 'contact':8A 'could':66B 'creat':61B 'custom':7A,39B,88B,127B,137B 'data':41B,72B 'detail':9A 'digicert':1A,22A,27B,80B,130B,133B 'dlpxxo':21A 'document':116B 'driver':13A,105B 'earli':25B 'early-warn':24B 'email':97B 'endpoint':60B 'expos':3A,94B 'feb':50B 'got':89B 'hold':37B 'intern':4A,34B 'internet':46B 'issu':140B 'issuanc':136B 'jul':78B 'jun':75B 'leak':6A 'licenc':15A,107B 'login':138B 'mfa':64B 'migrat':52B 'minor':120B 'name':95B,113B 'name-and-address':112B 'need':148B 'notic':90B 'nov':93B 'number':99B,124B 'oct':85B 'one':134B 'outsid':70B 'passport':12A,104B 'phone':98B 'plus':103B 'reachabl':43B 'read':67B,71B 'record':69B 'replac':149B 'say':131B 'self':55B 'self-servic':54B 'servic':56B 'sign':58B 'sign-up':57B 'small':119B 'system':36B 'unknown':129B 'util':17A,108B 'valid':40B 'warn':26B 'without':63B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["digicert"],"ptokens":["digicert"],"labels":["campaign","earlywarning","medium","vendor"],"campaign_type":"breach","first_public_at":"2026-11-05T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-dlpxxo","url":"https://gbhackers.com/digicert-confirms-data-breach/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-05T16:35:10+00:00","fetched_at":"2026-11-05T16:35:10+00:00","note":null,"cites":["https://gbhackers.com/digicert-confirms-data-breach/"]}],"documents":[{"id":77579,"url":"https://x.com/BleepinComputer/status/2118376075277340952","title":"@BleepinComputer: DigiCert data breach exposes customer information, identity documents\nhttps://t.","kind":"post","source":"x","publisher":null,"text":"DigiCert data breach exposes customer information, identity documents\nhttps://t.co/PsHPg7jmyw\n\nhttps://t.co/PsHPg7jmyw\n\nlikes 8 reposts 5","published_at":"2026-11-05T16:13:08+00:00","relation":"describes","confidence":null,"note":null},{"id":77596,"url":"https://gbhackers.com/digicert-confirms-data-breach/","title":"DigiCert Confirms Data Breach After Security Misconfiguration Exposes Customer Personal Information","kind":"other","source":"analyst","publisher":null,"text":"DigiCert incident report (Bugzilla): internal archived-customer-data business system exposed to internet since 4 Feb 2025 migration; self-service registration endpoint created non-MFA read-only accounts that could read archived records. Unauthorized access 27 Jun - 2 Jul 2026; patched 2 Jul; confirmed reportable 19 Oct 2026. Data: names, business emails, phones, business addresses; small minority of accounts also passports, driver's licences, utility bills. No customer count. CertCentral, DigiCert ONE, CA services, customer logins and issued certificates not affected; no revocation needed. Customers notified by 4 Nov (Troy Hunt, Jameson Lopp received notices).","published_at":"2026-11-05T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}