DigiCert disclosed that a February 2025 server migration mistakenly exposed an internal business system to the internet, allowing external users to create accounts and read archived customer information in read-only mode. The breach, discovered in June 2026, was later confirmed to have accessed data between June 27 and July 2, 2026. Affected records include names, business email addresses, phone numbers, business addresses, and, where provided, identification documents such as driver’s licenses, passports or utility bills. DigiCert has sent breach notifications, is reviewing identification documents, and has restricted access, disabled self-registration and added extra access controls. The company says its CertCentral and DigiCert ONE platforms, customer login credentials and issued certificates remain secure. 1