A 2025 server move put a DigiCert system on the internet. Customer IDs were readable.
By Lior AharonovFounder, 7IT Solutions ·
What happened
DigiCert says a February 2025 migration exposed an internal system that used to sit behind a VPN. An outside account read archived customer data between 27 June and 2 July 2026: names, business emails, phones, and for some people passports or driver's licenses. Certificate issuance was not affected, per BleepingComputer.
Why it matters
You trust your certificate vendor with proof of who you are. The company found the open door in June 2026 but confirmed data access only on 19 October. DigiCert has not said how many people are affected.
What to do
If DigiCert emails you, treat the business contact details you gave as public and watch for phishing that uses them. Then check that no internal system of yours went public after a migration.
My take
Lior Aharonov
Founder, 7IT Solutions
Most breaches are not clever. A migration quietly drops the VPN and nobody checks for months.
Sources
| BleepingComputer: DigiCert data breach exposes customer information, identity documents | bleepingcomputer.com |
Researched with AI tools; every fact is checked against the linked sources.