2026-11-07
DigiCert (Certificate Authority) Internal Business System Breach: Customer Representatives' Contact Details and Some ID Documents, and What Customers Should Do
In an incident report on Mozilla Bugzilla (full report posted around November 2, 2026, Japan time), DigiCert says it found unauthorized access to an internal business system that archives information customers provide to validate their identity. The data accessed was between June 27 and July 2, 2026. Most of it was business contact details (names, business email addresses, phone numbers, business addresses); in a small minority of customer accounts there was also a customer-provided document such as a driver's license, passport or utility bill. The access was read-only. DigiCert says 0 certificates were affected, that its CA systems, CertCentral and DigiCert ONE were unaffected, and that no action is needed for active certificates. It has not published how many records or people are involved. This site's conclusion: customer admins should treat any message that uses their validation details as unverified until checked in a portal they open themselves, and anyone who submitted ID documents should watch for identity misuse.