The security exposure originated from a February 2025 infrastructure migration that inadvertently moved an internal business system from a VPN-restricted segment to an internet-accessible zone without proper explicit authorization controls. Unauthorized access compromised archived customer contact details, including names, business email addresses, phone numbers, and company addresses. A small minority of affected accounts also exposed customer-provided verification documents, such as passports, driver’s licenses, and utility bills. DigiCert confirmed that its core Certificate Authority services, CertCentral, DigiCert ONE, customer login credentials, and issued cryptographic certificates remain entirely safe and uncompromised.After fixing the authorization gap in July 2026 and concluding internal forensic reviews, DigiCert formally confirmed the unauthorized data access in October and began issuing direct notifications to impacted individuals.

Full report : An infrastructure migration misconfiguration exposed DigiCert servers leaking business contact details and sensitive identity documents.