Are You a DigiCert Customer? Learn About Your Options After the November 2026 Data Breach

DigiCert, a major certificate authority, began notifying customers in early November 2026 that an internal business system was mistakenly exposed to the internet and that an unauthorized account accessed archived customer information. The incident was reported by BleepingComputer on November 5, 2026 and is described in an incident report DigiCert filed with Mozilla's public compliance tracker.

According to those reports:

• A February 2025 server migration left an internal business system reachable from the internet; it had a self-registration feature that let outsiders create accounts
• Between June 27 and July 2, 2026, an unauthorized account was able to read archived customer information in read-only mode
• DigiCert first treated the issue as an account-creation problem and confirmed on October 19, 2026 that archived data had been accessed
• The information involved was limited to names, business email addresses, phone numbers and business addresses; for some customers it may also have included an identification document such as a driver's license, passport, utility bill or other document showing a name and address
• DigiCert says the account could not modify records, approve validations or issue certificates, and that its certificate services and customer logins were not compromised

DigiCert has said it is still reviewing identification documents to determine who was affected and will notify those individuals once that review is complete. It has not said how many people were affected.

If you are, or were, a DigiCert customer and received a notice about this incident, you can see if you may qualify to connect with an independent attorney.