Vendor incident, severity critical
DigiCert breach exposes archived customer PII and identity documents via exposed internal system
Published
DigiCert disclosed that a February 2025 server migration exposed an internal business system to the internet. An unauthorized account used an authorization flaw to read archived customer data between June 27 and July 2, 2026. The data included names, business emails, phone numbers and addresses, and for some customers identity documents such as passports, driver's licenses and utility bills. DigiCert says CertCentral, DigiCert ONE, certificate issuance and customer login credentials were not compromised.
What's affected
- digicertevery version
Exposure window: to UTC.
What to do
- Watch for a DigiCert data breach notification and follow its guidance
- Check whether identity documents or contact details were submitted to DigiCert for certificate validation
- Be alert to phishing that uses the exposed names, business emails, phone numbers or addresses
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident digicert-data-breach-2026-11References
Notice digicert-data-breach-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.