For: certificate administrators, security and IT teams, and people who gave DigiCert identity or organization-validation information. This article is based on the company's own incident report and does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
certificate administrators, security and IT teams, and people who gave DigiCert identity or organization-validation information.
- Confirmed so farSee the table ↓
- Unauthorized access
- Access window
- Contact details (names, business email, phone, address)
1 more
- Customer-provided documents (driver's license, passport, utility bill, etc.)
- Not yet confirmed
- How many records and people are affected
- Which people's ID documents are involved (DigiCert says its review is ongoing)
- Completion of the remaining action item to confirm no externally accessible origin server
2 more
- What first led DigiCert to suspect the access on October 12
- Whether the data has been misused (follow-on harm)
- What to do nowSee the steps ↓
- Verify anything claiming to be DigiCert through a portal you opened yourself
- If you submitted ID documents, watch for identity misuse
- Do not reissue certificates just because of this (DigiCert's statement)
2 more
- Treat a breach notice the same way
- Brief the people who handle validation
- Where to verify (source)All sources ↓
- DigiCert, "DigiCert: Unauthorized access to business system", Mozilla Bugzilla bug 2084460 (English; preliminary report October 21 UTC, full report posted November 1 UTC, comments through November 6 UTC; checked November 7)
- Last checked
- As of November 7, 2026
Follow-up plans and what we checked
DigiCert posted a full incident report in the Mozilla Bugzilla bug on its own account. A participant has asked it for numbers on the data set and for what prompted the October 12 suspicion; as of the check on November 7 we found no DigiCert reply to those questions. Updates would appear in the same bug.
What DigiCert customers should do today
Verify anything claiming to be DigiCert through a portal you opened yourself
Contact details and the fact that you went through validation are exactly what a fake message would use. This is a general risk of the data involved, not something DigiCert says is happening.
- Do not use links or attachments in a message asking you to revalidate, resend documents, confirm an account or update payment details
- Open the portal yourself (from a bookmark or typed address), or call your known account representative, and check whether any request is pending (this site's addition, What is phishing)
If you submitted ID documents, watch for identity misuse
DigiCert's report says a small minority of customer accounts included a customer-provided document such as a driver's license, passport or utility bill. According to press reports, DigiCert is still working out who is affected and will notify them. Do not wait (this site's advice).
- List which documents you or your colleagues submitted for validation
- Watch for new accounts, credit applications and contacts that use your name and address
- See What to do after a driver's license data leak for the kinds of misuse and how to stop them
Do not reissue certificates just because of this (DigiCert's statement)
DigiCert says no certificates were issued, modified or revoked, that its CA systems, CertCentral and DigiCert ONE were unaffected, and that no action is needed for active certificates. Keep your normal expiry and renewal management.
Treat a breach notice the same way
A fake notice that imitates the real one is a likely follow-on. If you get a notice, check that it matches what you can see in your own portal or through your known representative before clicking anything (this site's addition).
Brief the people who handle validation
Tell the contacts registered for organization validation, and the individuals who uploaded documents, about this incident and the check above. Messages may go to the individual, not only to the administrator (this site's addition).
1. A message arrives about revalidation, documents or an account check
Even if it names your organization and contact, it may not be genuine
↓
2. Do not open links or attachments, and do not reply
↓
3. Check in the portal you opened yourself, or with your known representative
Until then, send no documents and approve nothing
What happened (from DigiCert's report)
The following is based on the incident report DigiCert filed on Mozilla Bugzilla (preliminary report October 20, full report posted around November 2, 2026 Japan time).
February 4, 2025
An infrastructure migration moved the internal business system from a VPN-restricted network segment to one that was externally accessible (DigiCert's report)June 18, 2026
An internal reviewer saw accounts that were not DigiCert's and judged they had no data access. The system was put behind a web application firewall (WAF), which blocked new account creation from outsideJune 21 to 24, 2026
A managed security research program reported that accounts could be created from outside (June 21). DigiCert verified it (June 24)June 27 to July 2, 2026
The period during which archived data was accessed, as established by the later investigation. An authorization fix was released to production on July 2October 12, 2026
DigiCert first suspected unauthorized access to the archived data and began a further investigationOctober 19 and 20, 2026
DigiCert confirmed access to a subset of archived data and judged it a reportable event (October 19). It filed a preliminary report dated October 20 (posted to Bugzilla on October 21, Japan time)November 5, 2026
Press reported that DigiCert had begun notifying affected customersNovember 7, 2026
This site checked the bug. No DigiCert reply on the number of records
- System
- An internal business system used to archive information customers provide, including the information customer representatives give to validate their identity
- Contact data
- For most of the data: names, business email addresses, phone numbers and business addresses
- Documents
- In a small minority of customer accounts, a customer-provided document such as a driver's license, passport, utility bill or another document with a name and address
- Nature of access
- Read-only. The report says the access could not write records, act as a validation approver or issue certificates, and that a logs review found no validation actions, issuance or revocation tied to the account
- Not affected
- CA services (which run on their own network segments), CertCentral and DigiCert ONE, none of which were affected. Customer login credentials and issued certificates remain secure, according to the company
- Cause (company's account)
- After the migration the system was reachable from outside, and an account-registration feature meant for other uses became available. Accounts created through it had no multi-factor authentication and were read-only by default, but could read the archive
- Company response
- The registration endpoint was blocked at the WAF, an authorization fix was released, access was restricted to VPN traffic, a penetration test, new alerts, password resets for the system's users, deactivation of self-registration, private load balancers and a least-privilege review followed. Two items, due November 6, were still listed as ongoing in the report; the company later said one (alerting) is complete
- Customers
- The report says no action is needed for active certificates. Press reports that DigiCert has begun sending notices and is still reviewing ID documents to determine who is affected
What we know and what we don't
State as of November 7, 2026. When DigiCert posts updates, we will rewrite this table.
| Item | What DigiCert says | Status |
|---|---|---|
| Unauthorized access | Confirmed on October 19, 2026 as access to a subset of archived data | Confirmed (company) |
| Access window | June 27 to July 2, 2026, from the later investigation | Confirmed (company) |
| Contact details (names, business email, phone, address) | Most of the data involved | Affected (company) |
| Customer-provided documents (driver's license, passport, utility bill, etc.) | A small minority of customer accounts. Press reports DigiCert is still reviewing who is affected | Affected (company) |
| Writing or changing records, approving validations, issuing certificates | The access could not do these | Not included (company) |
| Certificates | 0 affected. None issued, modified or revoked | Not included (company) |
| CA systems, CertCentral, DigiCert ONE | CA systems run on their own network segments; all three were not affected | Not included (company) |
| Customer login credentials | Remain secure | Not included (company) |
| Number of records or people | Not stated. A participant has asked for numbers | Not stated |
| What prompted the October 12 suspicion | Not stated. A participant has asked | Under investigation |
| Remaining action item (confirm no externally accessible origin server) | Due November 6 and listed as ongoing in the report | Under investigation |
| Misuse (follow-on harm) | Not stated | Not stated |
Why we write Affected
DigiCert describes the kinds of data that were in the archive and accessed, but gives no counts, and says its document review continues. We follow its wording and do not turn this into a number of people.
What contact details and ID documents make possible
The following is what can generally happen with this combination of data. It is not something DigiCert says happened in this incident.
- Name + business email + phone + address: shows who handles certificates and validation for an organization, enough to address a convincing message to the right person
- Knowing that a person went through validation: material for a fake revalidation, document-resubmission or account-check message
- ID document (license, passport, utility bill): can be used for impersonation, opening accounts or fake identity checks, which is why the guide linked above applies
- No effect on certificates: according to DigiCert, nothing was issued or changed, so there is no reason in its account to distrust existing certificates because of this incident
What certificate and system operators should review
DigiCert published the cause and its lessons. Below are those, plus general points that follow from them.
- Security review for network changes to internal tools: DigiCert's report lists, as a lesson, that changes to the network accessibility of internal systems should always require a security review. Treat migrations as security changes too
- Do not let network position stand in for authorization: another lesson in the report. A system behind a VPN still needs its own access checks
- Check which defaults ship with shared platforms: the report says an optional registration feature came with the account platform. Turn off what a system does not need
- Alert on new accounts and bulk reads: the report says alerts on account creation and request volume were added after the fact
- Keep fewer identity documents, for less time: archives of customer-provided documents raise the cost of any access (this site's general point)
These are general review points and do not mean other organizations failed to do them.
Sources (public record)
The facts in this article come from the public information below. We do not speculate about unpublished record counts or about whose documents are involved.
- DigiCert, "DigiCert: Unauthorized access to business system", Mozilla Bugzilla bug 2084460 (English; preliminary report October 21 UTC, full report posted November 1 UTC, comments through November 6 UTC; checked November 7) — bugzilla.mozilla.org
- Press: BleepingComputer (English, November 5, 2026), the report behind the sentences about customer notices — bleepingcomputer.com
Update history
2026-11-07: First version. Based on DigiCert's incident report on Mozilla Bugzilla (checked November 7; latest comment dated November 6 UTC).
Read next
- If an ID document is involved: What to do after a driver's license data leak
- A similar case of vendor contacts and conversation history: WorkOS internal sales app breach
- Preparing for scam messages: What is phishing
- Other 2026 incidents: Data breaches and cyberattacks (Japan and overseas)