DigiCert Discloses Customer Data Exposure From a 2025 Server Migration Error: What B2B Buyers Should Do

Certificate authority DigiCert reported the incident in a filing to Mozilla's CA program, and coverage followed on November 6, 2026 from The Register and teiss. The company has not said how many people were affected.

What Happened and When

On February 4, 2025, DigiCert moved an internal business system out of a VPN-restricted network segment without a security review, making it reachable from the internet. The system archived customer-provided verification information.

• June 18, 2026: staff noticed accounts that did not belong to DigiCert employees.
• June 21, 2026: a managed security program report flagged that outsiders could create accounts.
• June 27 to July 2, 2026: an unauthorized account read some archived records.
• July 2, 2026: an authorization fix was released.
• October 12 and 19, 2026: DigiCert first suspected, then confirmed, access to archived data.
• October 20, 2026: a preliminary incident report was filed, according to the public Mozilla Bugzilla report.

What Data Was Exposed

DigiCert says the exposed data was mostly business contact details: names, business email addresses, phone numbers and business addresses. A small share of records also held identity documents such as passports, driver's licenses or utility bills.

DigiCert states the account had read-only access, that no certificates were issued, modified or revoked through it, and that CertCentral and DigiCert ONE were unaffected. Customers do not need to replace active certificates, per the company. The number of affected individuals has not been disclosed.

Why the Root Cause Matters

The incident report lists three causes: a network change made without security review, weak monitoring of account activity, and an authorization model that did not account for self-registered accounts. These are common failure modes in any SaaS or internal system.

Notably, the exposure window ran for roughly 16 months before anyone accessed the data, and the access itself lasted days. That gap shows how long a misconfiguration can sit unnoticed without asset inventory and change controls.

What It Means for B2B SaaS Buyers and IT Teams

If you buy certificates, identity verification or any service that stores your verification documents, this is a reminder that vendor archives can outlive their purpose. Ask what the vendor keeps, for how long and where.

• Companies that submitted identity or business documents for certificate validation may receive notification and should read it closely.
• Security teams should treat vendor notices as potential phishing bait, since attackers may use leaked contact details.
• Procurement should add data retention and deletion terms to renewals.

What to Do Now: A Practical Checklist

Act on the parts you control: confirm whether you were affected, tighten vendor oversight and check your own exposed systems. None of these steps require replacing certificates unless DigiCert advises it.

• Check your inbox and security contacts for notification from DigiCert, and ask your account manager what records of yours were archived.
• Warn staff who were named on validation records to expect targeted phishing.
• Review the vendor's retention policy and request deletion of verification documents no longer needed.
• Audit your own network changes: require security review before moving systems between network segments, in line with the access control family in NIST SP 800-53.
• Alert on new account creation in business-critical systems and disable self-registration where not needed.
• Add this vendor to your third-party risk register and record the incident.

Related SaaSPodium Categories

If you manage certificates or vendor risk, these directories help you compare options. Our SSL certificates software category lists certificate providers including DigiCert, and third-party and supplier risk management software helps track vendor incidents like this one.

For access hardening, see identity and access management software, which covers MFA and account lifecycle controls that address the kind of self-registration gap described above.

Frequently Asked Questions

Do I need to replace my DigiCert certificates after this incident?
DigiCert states that customers do not need to replace active certificates, and that CertCentral and DigiCert ONE were unaffected. Follow any specific guidance in notifications you receive from DigiCert.

How do I find out if my data was affected?
DigiCert says it is notifying affected customers and reviewing identity documents to determine who was involved. Contact your DigiCert account representative and your security contact list for confirmation.

How should we assess certificate vendors after an incident like this?
Review the vendor's incident report, retention practices, authentication controls and change management. Ask for evidence of monitoring and security review for network changes, and record the findings in your vendor risk register.