DigiCert has disclosed unauthorized access to archived customer data after a server migration exposed an internal business system to the internet. The company says the access occurred between June 27 and July 2, 2026, and that it has begun notifying affected customers. BleepingComputer reports that DigiCert described the affected archive as a small portion of customer data, but has not provided an impact count.
The exposed system had a self-registration feature that allowed an external user to create an account. According to SecurityWeek’s account, the account did not require multifactor authentication and was granted read-only access to archived information. DigiCert later determined that the account had accessed names, business email addresses, phone numbers and business addresses. Some records may also have contained driver’s licenses, passports, utility bills or other documents supplied for certificate-related verification.
This was confirmed data access, not merely an attempted account creation. BleepingComputer reports that DigiCert initially treated the issue as an account-creation event and only confirmed archived-data access during a further investigation on October 19. The company says the account could not modify records, approve certificate validations or issue certificates; SecurityWeek also reports that DigiCert’s certificate authority systems were on separate network segments and were not affected.
DigiCert says it restricted access to the system, disabled self-registration and added access controls. SecurityWeek reports additional monitoring and alerting, removal or verification of remaining non-DigiCert accounts, password resets for business-system users, and checks on system ownership and permission enforcement. No CVE, affected product version or official public remediation advisory is identified in the fetched reporting, and the number of affected customers remains unresolved.