Years ago a developer photographed their driver’s license and uploaded it to DigiCert. The company wanted proof of who they were before it would issue a certificate. Nobody deleted that photo afterward. It went into an archive, and for six days this summer a stranger with a self-made account could open it and read the name, the work email address, the phone number and the business address sitting beside it. The DigiCert data breach is the story of that archive.
Confirmation: confirmed by the company, in its own full incident report filed with Mozilla on November 1, 2026.
What happened in the DigiCert data breach
On February 4, 2025, DigiCert moved an internal business system out of a VPN-restricted network segment and into a different availability zone. The move was routine infrastructure work. It also, by accident, put that system on the public internet.
The system ran an account manager with a self-registration feature built for other applications. So anyone outside the company could now make an account on it. Those accounts skipped the multi-factor authentication DigiCert requires elsewhere, and they arrived in read-only mode by default. Read-only still reads: they could open archived customer records.
DigiCert’s own timeline shows how long the penny took to drop. On June 18, 2026, an internal reviewer spotted non-DigiCert accounts on the system and concluded they had no data access, because nothing had assigned those accounts to an application. Three days later a managed security research program reported that outsiders could register. Engineering traced the root cause on June 30, then shipped an authorization patch on July 2.
The company believed that closed it. On October 12 it began to suspect the archive itself had been read, and on October 19 it confirmed the window: June 27 through July 2, 2026. Six days. In DigiCert’s own words, “the incident was initially handled as an account-creation issue rather than a data-access event.”
What the DigiCert data breach exposed, item by item
Most records held business contact information: names, business email addresses, phone numbers and business addresses. A small minority also held a customer-provided document — a driver’s license, a passport, a utility bill, or another document carrying a name and an address.
Each piece does a different job for a criminal.
- A work email address is the delivery route. It is where the follow-up phish arrives, dressed as DigiCert.
- A name and a phone number make that phish credible. A caller who already knows your name and your employer sounds like a vendor you use.
- A business address fills the last blank on a fraudulent credit or account application.
- A driver’s license or passport scan is the hardest item to replace. You can change a password in a minute, but a passport number stays with you for a decade.
DigiCert says the access could not write records, act as a validation approver, or issue certificates. It also says the breach left its certificate authority services, CertCentral and DigiCert ONE untouched, and that issued certificates stay valid and trusted. The count, however, is still open. The company describes “a small proportion of archived data” without publishing a figure, and nobody had answered the request for numbers on the public incident thread as of November 6.
What to do now
Most of this has nothing to do with OptMsg.
- If you ever sent identity documents to DigiCert, watch for a notification letter. The company says it is still reviewing those documents to work out whom this reached.
- Treat any message about your DigiCert account as unverified until you check it yourself. Open a new tab and type the address in, because the link inside the message is the part an attacker controls.
- Turn on the strongest sign-in each of your accounts offers. A passkey beats an authenticator app, and an authenticator app beats a code sent by text.
- Use a password manager, so one leaked password cannot open a second account.
- If a passport or license number was in there, consider a credit freeze at each of the three bureaus. It is free, and it blocks the account-opening fraud those documents enable.
How OptMsg changes this exposure
Here is the honest size of it. OptMsg could not have stopped what happened inside DigiCert’s network, because that was another company’s server and another company’s archive. What it changes is the step that comes next, on your side.
Two mechanisms do that work. First, your OptMsg account has no password, so a password stolen from another site cannot open your inbox. Credential stuffing needs a password to try, and your OptMsg account does not have one. Second, mail from a sender you have not approved goes to Trash rather than your Inbox, and it auto-deletes after 30 days. The follow-up phish dressed as a certificate authority lands there instead of in front of you at nine in the morning.
What the argument does not cover, plainly: a compromised device, a live phishing page you type your details into, or someone holding your unlocked phone. It also does nothing about a document already sitting in somebody else’s hands. This patent-pending opt-in technology narrows the blast radius on your side of the wire, and that is its real size.
If you want an inbox built that way, you can create an account in a couple of minutes. Our security-first page lays out how we think about sign-in.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Was the DigiCert data breach a hack of its certificate systems? No. DigiCert says the breach left its certificate authority services, CertCentral and DigiCert ONE untouched, and that it issued, modified or revoked no certificates as a result. The access was read-only, on a separate business system that archives information customers provided to validate their identity.
How many people did the DigiCert data breach affect? DigiCert has not published a number. Its full incident report describes “a small proportion of archived data,” As of November 6, 2026 nobody had answered a request for figures on the public incident thread.
What data leaked? Names, business email addresses, phone numbers and business addresses. A small minority of records also held a customer-provided identity document, such as a driver’s license, a passport or a utility bill.
How long were the records readable? The system sat on the public internet from February 4, 2025. DigiCert’s investigation narrows the actual data access to June 27 through July 2, 2026, a window of six days.
Do I need to replace my DigiCert certificates? DigiCert says no. It states that customer login credentials and issued certificates remain valid, trusted and fully usable, and that customers need take no action on active certificates.
Sources
- BleepingComputer, “DigiCert data breach exposes customer information, identity documents,” November 5, 2026 — https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/
- DigiCert, Full Incident Report, Mozilla Bugzilla bug 2084460, November 1, 2026 — https://bugzilla.mozilla.org/show_bug.cgi?id=2084460
Previous in Breach Breakdown: The Harvard Data Breach Leaked A Profile, Not A Password
