# DigiCert Data Breach Exposes Business Customer Information

*Published November 9, 2026*
*Source: [https://www.securityweek.com/digicert-data-breach-impacts-business-customer-information/](https://www.securityweek.com/digicert-data-breach-impacts-business-customer-information/)*

## Executive Summary

DigiCert disclosed a data breach where attackers accessed business customer contact information by exploiting a self-registration feature. The breach affected names, emails, phone numbers, and addresses, but did not compromise the core certificate authority systems.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/digicert-data-breach-exposes-business-customer-information) or [see plans](https://www.sec-news.ai/pricing).*

## Article

DigiCert, a prominent provider of digital security solutions, has revealed a data breach that compromised the contact information of its business customers. The breach stemmed from an internal business system used to archive customer data, which was inadvertently exposed to the internet after being moved to a different network segment in February 2025. Attackers exploited a self-registration feature in the account management system to create a read-only account, allowing them access to archived data from June 27 to July 2.

The unauthorized account was disabled on July 2, but it was not until October that DigiCert confirmed the breach of customer contact information. The data accessed included names, email addresses, phone numbers, and business addresses. In certain cases, documents such as driver's licenses, passports, and utility bills were also compromised. Importantly, DigiCert assured that the access did not allow for altering records, approving validations, or issuing certificates as their CA systems remained secure and unaffected.

Initially treated as an account creation anomaly, the incident prompted further investigation on October 12 when suspicions arose about the unauthorized access to archived data. In response, DigiCert has strengthened its security measures by implementing additional monitoring, removing unauthorized accounts, resetting user passwords, deactivating the self-registration feature, and verifying system ownership and permission policies. The exact number of affected customers has not been disclosed by DigiCert. SecurityWeek has reached out to the company for more details and awaits a response.