The DigiCert data breach exposed a risk every small business faces: you trust vendors with sensitive documents, and when their security fails, your compliance obligations begin. DigiCert confirmed on October 19, 2026, that unauthorized access to an internal business system exposed archived customer contact details and identity documents. Names, business email addresses, phone numbers, and business addresses were accessible. For a small number of accounts, the breach included passports, driver’s licenses, utility bills, and other documents showing names and addresses.
The breach did not affect DigiCert’s Certificate Authority services, CertCentral, or DigiCert ONE. Customer login credentials and issued certificates remain secure. Investigators found no certificate issuance, validation changes, or revocation activity linked to the unauthorized account. Customers do not need to replace active certificates because of this incident.
The exposure raises a question every business owner should ask: when a vendor you rely on reports a breach, what must you do next?
What happened in the DigiCert breach?
DigiCert moved an internal business system from a network segment restricted by a virtual private network to another availability zone on February 4, 2025. That change accidentally made the internal system accessible from the internet without a security review of its new exposure.
An account registration feature, intended for other uses of the account management platform, also became available. Accounts created through that feature were not covered by the multifactor authentication required for DigiCert staff. Although these accounts had no application assigned, they received read-only access to archived information, revealing a gap in permission checks.
A report from DigiCert’s managed security research program followed on June 21. Engineers confirmed the registration issue and released an authorization fix on July 2. Investigators later established that unauthorized data access occurred between June 27 and July 2.
DigiCert initially treated the problem as an account-creation issue rather than a data-access incident. The company first suspected access to archived information on October 12. DigiCert confirmed the unauthorized data access on October 19, 2026, and filed its preliminary incident report the following day.
Why does this matter if your certificates are safe?
Picture a professional services firm that submitted a business license, a utility bill, and a passport scan to validate domain ownership. Those documents sat in an archived system for months. When that system becomes internet-accessible, someone outside the vendor now holds copies of identity documents that can be used to open financial accounts, file fraudulent tax returns, or social-engineer access to other services.
The certificates themselves are fine. The identity documents are not.
If your business submitted identity documents to DigiCert, or to any vendor, ask what happened to those files after validation. Ask whether they were deleted, archived, or moved to another system. Ask whether that system underwent a security review during every infrastructure change.
If you cannot get a clear answer, treat the documents as exposed and prepare a response.
Do you have a notification obligation when a vendor reports a breach?
The answer depends on what was exposed, who it belongs to, and what your state or industry requires. If the vendor held employee identity documents, you hold employee personal information. If the vendor held client documents submitted during onboarding, you hold client personal information.
Engage legal counsel experienced in breach response the day you receive a vendor breach notice. Do not wait to see whether the vendor notifies on your behalf. Ask your attorney whether you must notify employees, clients, or regulators directly, and ask for the timeline your state law or contract sets.
If you operate in a regulated industry, ask whether the breach triggers a reporting obligation even if the vendor sent its own notice. Some regimes require you to report incidents involving service providers within a set window.
Document the vendor’s notice, the date you received it, the data types the vendor confirmed were exposed, and the actions you took in response. That timeline becomes the record your auditor, your insurer, and your attorney will ask for.
What should you audit in your vendor contracts today?
Review every contract with a vendor that holds identity documents, financial records, or client data. Look for breach notification language. Ask how quickly the vendor must notify you after discovering unauthorized access, and ask whether the window is measured in hours or days.
If the contract is silent, negotiate an amendment. Specify that the vendor must notify you within one business day of confirming a breach, and that the notice must include the data types affected, the window of exposure, and the steps the vendor took to contain the incident.
Ask the vendor for a copy of its most recent security audit or penetration test summary. Ask whether it maintains cyber liability insurance, and ask for evidence of coverage. If the vendor will not provide either, ask your attorney whether you should move that service to a provider that will.
Schedule a quarterly review of vendor access. List every vendor that can reach your systems, your client data, or your identity documents. For each one, ask whether it still needs that access, and whether you have tested your ability to revoke it.
How do you prepare for the next vendor breach before it happens?
Build a vendor breach response playbook before you receive the next notice. Assign one person to receive vendor security notices and forward them to your attorney, your IT provider, and your leadership team on the same day.
Pre-identify legal counsel experienced in breach response. Ask your attorney to draft template notification language for employees, clients, and regulators. Store those templates where the person who receives the vendor notice can find them.
Maintain a current inventory of every vendor that holds personal information, the data types each vendor stores, and the contract terms that govern breach notification. Update that inventory every time you onboard a new vendor or sunset an old one.
Test your playbook twice a year. Suppose a vendor emails your office manager on a Friday afternoon to report a breach. Walk through each step: who opens the email, who calls the attorney, who notifies leadership, who pulls the contract, and who checks the inventory for affected data types. If anyone in that chain is unavailable, ask whether the person covering for them knows where to find the playbook.
The DigiCert breach began in February 2025 and was not confirmed until October 2026. The gap between migration and discovery is a reminder that vendor security is not a one-time question. It is a standing audit item, and the cost of skipping that audit is a compliance obligation you did not see coming.
What happens if you submitted identity documents to a vendor years ago?
Call the vendor and ask whether those documents are still on file. If the answer is yes, ask whether they sit in an archived system, whether that system is subject to the same access controls as production systems, and whether the vendor plans to delete them.
If the vendor cannot answer those questions, or if it confirms the documents remain archived indefinitely, ask your attorney whether you should request deletion in writing. Send that request via email, copy your attorney, and retain the vendor’s response.
If the vendor confirms deletion, ask for written confirmation and a timeline. If the vendor refuses, document the refusal and ask your attorney whether you should move to a different provider.
Archived identity documents are not inert. They sit in systems that undergo migrations, updates, and configuration changes. Each change is an opportunity for access controls to drift, for permissions to widen, or for a VPN requirement to disappear. The longer the documents sit, the more changes they survive, and the more chances someone outside the vendor will find them.
FAQ
Do I need to replace my SSL certificates after the DigiCert breach?
No. DigiCert confirmed its Certificate Authority services, CertCentral, and DigiCert ONE were unaffected. Customer login credentials and issued certificates remain secure. Investigators found no certificate issuance, validation changes, or revocation activity linked to the unauthorized account. You do not need to replace active certificates because of this incident.
What should I do if I receive a vendor breach notice?
Engage legal counsel experienced in breach response the same day. Ask your attorney whether you must notify employees, clients, or regulators, and ask for the timeline your state law or contract sets. Document the vendor’s notice, the date you received it, the data types confirmed exposed, and the actions you took. That timeline becomes the record your auditor, your insurer, and your attorney will ask for.
How long should a vendor retain identity documents after validation?
Ask the vendor for its retention policy in writing. If the vendor archives documents indefinitely, ask your attorney whether you should request deletion. Send that request via email, copy your attorney, and retain the vendor’s response. If the vendor confirms deletion, ask for written confirmation and a timeline.
What should my vendor contracts say about breach notification?
Specify that the vendor must notify you within one business day of confirming a breach, and that the notice must include the data types affected, the window of exposure, and the steps the vendor took to contain the incident. If the contract is silent, negotiate an amendment. Ask your attorney to review the language before you sign.
How often should I review vendor access to my systems and data?
Review vendor access quarterly. List every vendor that can reach your systems, your client data, or your identity documents. For each one, ask whether it still needs that access, and whether you have tested your ability to revoke it. Update that inventory every time you onboard a new vendor or sunset an old one.
Keep reading
Sources
Source: DigiCert Confirms Data Breach Exposing Customer Details and Sensitive Identity Documents
Researched and drafted with AI, then reviewed and approved by Ron Trotto before publishing.