Managed IT

DigiCert Says an Exposed Internal System Leaked Customer Contact Details and Some ID Documents: What Small Businesses That Buy SSL Certificates Should Do

DigiCert disclosed that an internal system archiving customer validation information was accessed June 27 to July 2, 2026: mostly business contact details, plus ID documents for a small minority of accounts. Certificates are unaffected. A phishing, MFA and certificate-inventory checklist for financial firms, nonprofits and other small businesses.

November 8, 20266 min readBrotherly Technology

Certificate authority DigiCert has disclosed that an internal business system, one that archives information customer representatives provide so DigiCert can validate their identity, was accessed by an outside account between June 27 and July 2, 2026. In a full incident report posted to Mozilla's Bugzilla on November 1, DigiCert said most of the data was business contact information, and that a small minority of customer accounts also included an uploaded document such as a driver's license, passport or utility bill. DigiCert says its certificate services were not affected and no action is needed on active certificates. If your firm buys SSL/TLS or code-signing certificates from DigiCert, here's what that means and what to do.

What DigiCert says happened

According to DigiCert's incident report:

  • On February 4, 2025, the business system was moved from a VPN-restricted network segment during an infrastructure migration, which "inadvertently allowed this internal business system to be accessible externally."
  • A self-service account registration feature meant for other uses was reachable on that system. Accounts created that way were not subject to the multi-factor authentication DigiCert otherwise requires, and were read-only, but could still see archived data.
  • DigiCert identified the external exposure and an unassigned account starting June 21, 2026, and released an authorization fix on July 2. Its investigation later set the data access window as June 27 through July 2, 2026.
  • On October 19, 2026, DigiCert confirmed unauthorized access to a subset of archived data and determined it was a reportable event under browser root program rules.
  • Most of the data accessed was names, business email addresses, phone numbers and business addresses. "A small minority of customer accounts" also included a customer-provided document such as a driver's license, passport, utility bill or other document with name and address.
  • The access "could not write records, act as a validation approver, or issue certificates," and DigiCert says no certificates were issued, modified or revoked as a result.

DigiCert says its CA services, CertCentral and DigiCert ONE were unaffected, and that "customer login credentials and DigiCert-issued certificates remain secure, valid, and fully trusted." In a later follow-up on the same Bugzilla thread (posted the evening of November 6, Eastern time), DigiCert said it has contacted the affected customers with information specific to them and reported the incident to law enforcement. A DigiCert spokesperson told The Record that, to its knowledge, there is "no evidence of misuse of the information involved."

What we are not claiming: DigiCert has not said how many customers were affected, and has not named who was behind the account. We are not saying your certificates are compromised, that your DigiCert password was taken (DigiCert says login credentials were not), or that your ID documents were in the accessed data unless DigiCert has told you so. We are not saying anyone has misused the data. We are saying that if DigiCert notified you, the people at your firm who handle certificates should expect better-targeted phishing.

Why this matters for small firms

Accounting and financial firms, law offices, credit unions, nonprofits, manufacturers and medical practices often buy an organization-validated or extended-validation certificate for their website, client portal or VPN. To get one, someone at the firm (often the owner, office manager or controller) provides contact details and sometimes a photo ID. That is the kind of information DigiCert says was archived. The practical risk is not your website's padlock. It's a convincing email or phone call: "Your certificate is about to expire, click here to revalidate," sent to the exact person who handles renewals, with their real name, title and phone number.

What to do this week

  1. Check whether you were notified. Search the inboxes of whoever manages your certificates (and your IT provider) for a recent DigiCert incident notice. If you received one, read what it says about your organization's specific data.
  2. Don't touch working certificates because of this. DigiCert says no action is needed on active certificates. Don't revoke or reissue in a panic, and don't let anyone talk you into it over the phone.
  3. Treat renewal and "revalidation" messages as suspicious. Go to the certificate portal by typing the address yourself or using a saved bookmark, never through a link in an email. Verify phone requests by calling back on a number you already have.
  4. Turn on MFA for your certificate account if it isn't already, and confirm only current staff (and your IT provider) have access. Remove former employees.
  5. If an ID document was involved, act like it. If DigiCert told you a driver's license or passport was included, tell that person, consider a credit freeze, and watch for identity misuse.
  6. Know when your certificates expire. Keep an inventory (website, client portal, email, VPN, firewall) with expiry dates and owners, so a real renewal never comes as a surprise and a fake one stands out.
  7. Learn from the root cause. DigiCert says the system became reachable because the migration was "treated as an infrastructure change rather than a security change." Apply that to your own shop: any time a server, NAS, camera system or internal app moves networks or gets a new firewall rule, someone should check what just became reachable from the internet, and you should get an alert when a new account is created.

The takeaway for IT decision-makers

DigiCert says your certificates are fine. The exposure is the information behind them: who at your firm buys certificates, how to reach them, and in some cases their ID. Expect smarter phishing aimed at those people, keep renewals inside the portal you already use, and turn on MFA. The bigger lesson is DigiCert's own: an internal system went public through a routine change nobody reviewed as a security change, and it sat that way for more than a year. If you'd like a quick review of what in your environment is reachable from the internet, and who owns your certificates and renewals, Brotherly Technology can help.

Sources

One accountable technology partner.

Tell us what's slowing your team down. We'll show you exactly how we'd fix it — no pressure, no jargon.

Book a Free Consultation
Book a Free Consultation