DigiCert Archive Breach Shows the Long Life of Identity Documents

The DigiCert breach report concerns an archive of customer information. The company says attackers could read records but could not issue certificates or change validation decisions. Read-only access can still be a serious privacy problem when the records include identity documents.

The public Mozilla incident thread records DigiCert's account and later questions. Its statements should not be expanded into a claim that the certificate authority's signing systems were compromised.

What DigiCert says happened

DigiCert described a February 2025 migration that exposed an archived business system outside its previous VPN boundary. Unintended account registration enabled access without the required multifactor authentication. The disclosed data-access period ran from June 27 through July 2, 2026.

The company says it confirmed a reportable breach on October 19. Most affected information was business contact data. A minority of records included customer-supplied passports, driving licences, utility bills or similar identity evidence.

DigiCert said the access was read-only and did not reach certificate issuance, CertCentral or DigiCert ONE. It reported its listed corrective actions complete on November 6 and described notifications to affected customers and law enforcement. The reviewed thread did not supply a public total of affected individuals.

In a November 10 response, posted at 00:21 UTC, DigiCert said October 12 was when it first found evidence of unauthorized access. It declined to describe that evidence because of an ongoing law-enforcement investigation. The company also said the archive holds information supplied during service setup, authorizations and other interactions. The response did not provide a count of affected records.

Access controls for an old archive

An archive may no longer support ordinary customer work, but its contents can remain useful to an intruder. A document does not stop identifying someone when an internal team stops opening its folder.

That creates a maintenance problem. Moving an old application can change which network paths reach it. Keeping its historical access model without checking the new deployment can leave controls mismatched to the environment. This is the general operational lesson from the disclosed migration, not a claim to have tested DigiCert's infrastructure.

An organization should be able to name an owner for each archive, identify who can open it, and explain why each class of record remains necessary. Read access deserves explicit review. A permission model that prevents edits can protect the accuracy of records while leaving their confidentiality exposed.

Retention creates a continuing privacy obligation

The US Federal Trade Commission's business guidance recommends keeping sensitive information only while a legitimate business need requires it, controlling access and disposing of information securely when it is no longer needed.

That does not mean every organization can erase every record immediately. Retention decisions need to account for applicable obligations. Document the reason for retaining each kind of record and set a period for reviewing that decision.

A copied identity document presents a different recovery problem from a copied password. A person can change a password, but many details on a document describe a lasting identity or address history. Replacement procedures also depend on the document and issuing authority. Customers should ask what document was involved before deciding what response is appropriate.

Our explanation of KYC privacy risks covers the same separation between account security and the personal records an organization retains.

What affected customers can ask

Request the categories of information involved, the document dates and the instructions that apply to your record. Keep the notification so you can refer to its details. If a document issuer provides specific advice for compromised documents, use that official process rather than a paid service promoted in an unexpected message.

Organizations reviewing their own systems can use a simple exercise: identify an old archive, list its reachable interfaces and test whether a newly created account can read anything before approval. Do that only within systems they own or are authorized to assess.

Nothing in the reviewed disclosure supports indiscriminate replacement of TLS certificates as a response to this archive incident. Nor does the absence of certificate issuance access make the personal-data exposure inconsequential. The unresolved questions concern the full affected population and record-level impact.

Research checked November 10, 2026 UTC, including the company's response posted at 00:21 UTC that day.