---
id: "CMP-202611-dlpxxo"
kind: "campaign"
aliases: []
title: "DigiCert breached: exposed internal archive leaked customer contact details and some passports, driver's licences and utility bills"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "DigiCert", "fixed": [], "ecosystem": "vendor"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-05T16:35:10+00:00"
updated_at: "2026-11-05T16:35:38+00:00"
sources: [{"source": "analyst", "url": "https://gbhackers.com/digicert-confirms-data-breach/", "first_seen_at": "2026-11-05T16:35:10+00:00", "cites": ["https://gbhackers.com/digicert-confirms-data-breach/"]}]
exploit_sources: []
---

# DigiCert breached: exposed internal archive leaked customer contact details and some passports, driver's licences and utility bills

DigiCert, the certificate authority, confirmed that an internal business system holding archived customer validation data was reachable from the internet after a 4 Feb 2025 migration. A self-service sign-up endpoint created accounts without MFA that could read archived records; outsiders read data between 27 Jun and 2 Jul 2026. DigiCert confirmed it on 19 Oct 2026 and customers got notices by 4 Nov. Exposed: names, business emails, phone numbers and business addresses, plus passports, driver's licences, utility bills or other name-and-address documents for a small minority of accounts. The number of affected customers is unknown. DigiCert says CertCentral, DigiCert ONE, CA issuance, customer logins and issued certificates were not affected, and no certificates need replacing.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DigiCert affected range not listed fixed no fixed version listed

## How to check

- Check whether your organisation, or the people who did DigiCert identity/organisation validation, received a DigiCert breach notice email (sent from about 4 Nov 2026)
- List which staff gave DigiCert contact details or ID documents for OV/EV validation

## Fix

- No certificate rotation or password change needed per DigiCert
- Warn the staff named as DigiCert contacts to expect targeted phishing that uses their name, role and the DigiCert relationship (fake renewal, validation or 'reissue' emails)
- If ID documents were shared, follow the notice for identity-theft protection and watch for document misuse

## Timeline

- 2026-11-05T16:35:10+00:00 analyst https://gbhackers.com/digicert-confirms-data-breach/

## Documents

- [describes] @BleepinComputer: DigiCert data breach exposes customer information, identity documents
https://t. https://x.com/BleepinComputer/status/2118376075277340952
- [describes] DigiCert Confirms Data Breach After Security Misconfiguration Exposes Customer Personal Information https://gbhackers.com/digicert-confirms-data-breach/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_