DigiCert is notifying customers of a breach, BleepingComputer reports.
What happened
- A February 2025 server migration accidentally put an internal VPN-only system on the internet
- It had self-registration, and an authorization flaw let those accounts read archived customer data
- An unauthorized account accessed data between June 27 and July 2, 2026. DigiCert found odd accounts in June but treated it as “an account-creation issue rather than a data-access event” until October 19
- Exposed: names, business emails, phone numbers and addresses, and for some, driver’s licenses, passports or utility bills from validation
- DigiCert says CA services, CertCentral, DigiCert ONE, logins and issued certificates weren’t affected
My take
A certificate authority leaking validation IDs through a forgotten migration is rough, and the ID review is still going. If you’ve done OV/EV validation with them, watch for their notice and for identity-theft phishing.
God Bless, and Needs Garlic!
