A botched system migration at DigiCert moved an internal customer archive from behind a VPN to a publicly accessible network zone in February 2025, unintentionally exposing the data to the internet. The firm detected the intrusion in June 2026 and applied a fix in July 2026. The breach revealed names, business email addresses, phone numbers, business addresses and, in some cases, identity verification documents such as driver’s licenses, passports and utility bills. No login credentials or DigiCert-issued certificates were compromised, and DigiCert’s Certificate Authority services, CertCentral and DigiCert ONE remained unaffected. DigiCert said the migration changed network accessibility without a security review, exposing an account registration feature that allowed external accounts—without multifactor authentication—to read the archive. The company has since placed the archive behind a web-application firewall, blocked external account creation and added a security information and event management alert for blocked attempts. 1