5 min read
In October 2026, DigiCert—one of the largest certificate authorities on the internet—confirmed that an unauthorised party had accessed archived customer data from an internal business system. The root cause was a server migration error made back in February 2025 that left the system reachable from the open internet. By the time DigiCert filed its full incident report on 1 November 2026, the exposure had been sitting undetected for well over a year.
Most of the exposed records contained names, business email addresses, phone numbers and postal addresses. But for a subset of customers, the breach was more serious: identity-verification documents—passports, driver's licences and utility bills submitted during the certificate validation process—were also caught up in the archive. As of early November 2026, DigiCert was still reviewing the full scope of those documents, and customer notifications were only just beginning.
No certificates were compromised, no login credentials were exposed, and DigiCert's certificate authority services continued operating normally. That is a meaningful distinction. But it does not reduce the risk to individuals whose government-issued ID appeared in that archive—and it raises a broader question worth sitting with: every time you send an identity document to an online service, you are creating a risk that no future password reset can undo.
What Actually Happened
According to DigiCert's disclosure, an unauthorised account read data from an internal business system between 27 June and 2 July 2026. The access was not the result of a sophisticated attack on DigiCert's production infrastructure. It was the result of a configuration error—a server left internet-accessible during a migration in February 2025 that was simply never locked back down.
That gap of roughly sixteen months between the migration error and the detected access is striking. It suggests the system was either not monitored for anomalous access or not subject to regular network exposure audits. For customers who submitted ID documents years earlier during TLS certificate validation, there was no indication anything was wrong until notification letters began arriving in November 2026.
DigiCert has not disclosed the total number of affected individuals, which makes it difficult for people to assess their own exposure independently. As of 6 November 2026, the company was still cataloguing which accounts included identity documents—a process that itself signals the breach was broader in scope than a simple contact-details leak.
Why a Leaked Passport Is Not Like a Leaked Password
When a service loses your password, the standard advice is clear: change the password, enable two-factor authentication, check whether the same password was reused elsewhere. It is disruptive but recoverable. The damage is bounded.
A leaked passport photograph, passport number, date of birth and facial image cannot be rotated. You cannot issue yourself a new face. While it is possible to apply for a new passport number after a confirmed identity document compromise, the process is lengthy, not guaranteed, and the old number does not simply stop being useful to someone who already has a copy of the document.
The practical risks for affected individuals include:
- Impersonation attacks — an attacker with your passport scan and email address has what they need to attempt account takeovers on services that use document-based identity verification, including banks, telecoms providers and government portals.
- Social engineering — combining a full name, business email, phone number and a photo ID gives a fraudster a convincing profile to work with when targeting colleagues or family members.
- Synthetic identity fraud — fragments of verified identity information are combined with fabricated details to create new fraudulent identities, a category of fraud that can take years to surface.
- Long-horizon risk — unlike a breached email address, which often surfaces on credential-checking tools fairly quickly, a leaked document image may circulate in private channels for years before it is used.
Security professionals have pointed out that the value of a government-issued ID in a criminal marketplace tends to be durable precisely because the victim cannot easily invalidate it. That is what makes this category of breach qualitatively different from a typical credential dump.
The Structural Problem: Verification Requires You to Hand Over the Keys
DigiCert's Extended Validation and Organisation Validation certificate processes require customers to prove who they are. That is a reasonable requirement for a certificate authority—the whole point of a CA is to vouch for identities, and you cannot vouch for an identity you have not verified. So customers submitted their documents in good faith, as the process required, and those documents were retained.
This points to a structural tension that extends well beyond DigiCert. Identity verification has become a standard step in an enormous range of online services: opening a bank account, registering a domain, buying or selling on certain platforms, applying for professional licences. Each of those processes creates a copy of your identity document sitting on someone else's servers. Each copy is a liability.
You often have no meaningful choice about whether to submit the document if you want to use the service. What you can control is your awareness of the risk and your response if something goes wrong.
What Affected Individuals Should Do Now
If you have submitted identity documents to DigiCert at any point—particularly if you have been involved in obtaining TLS certificates under validation types that require identity proofing—and you have received a notification, or suspect you may be affected, the following steps are worth taking promptly.
Contact your passport authority
In the UK, His Majesty's Passport Office allows you to report a compromised passport. This does not automatically result in a new passport number, but it creates a record. For driving licences, the DVLA has a process for reporting identity fraud involving your licence details. Document the report reference number.
Place a notice with the main credit reference agencies
Experian, Equifax and TransUnion all allow you to add a notice of correction or a CIFAS protective registration to your credit file. A CIFAS marker prompts additional checks before credit is issued in your name. It does not prevent legitimate applications but does create friction for fraudulent ones.
Be sceptical of unsolicited contact
An attacker with your name, email, phone number and a copy of your passport has everything needed for a convincing impersonation. Be especially careful with any unexpected calls or messages purporting to be from your bank, employer, or a government agency in the weeks and months following a breach notification. Legitimate organisations will not ask you to confirm identity document details over an unsolicited call.
Monitor for new account openings
Regularly check your credit reports for accounts you do not recognise. All three UK credit reference agencies offer free statutory reports, and several offer ongoing monitoring services. Any unfamiliar entry is worth investigating immediately rather than assuming it is an administrative error.
What This Means for How You Think About Identity Verification Going Forward
This incident will not be the last of its kind. Organisations that collect identity documents as part of their compliance or verification obligations are holding sensitive material that is valuable to attackers and difficult to protect indefinitely. Configuration errors, misconfigured migrations, and long-undetected exposures are not unique to DigiCert—they reflect the operational reality of large-scale infrastructure management.
The practical implication is that you should treat any service asking for a government-issued document with the same seriousness you would apply to handing that document to a stranger. Ask yourself whether you understand why the document is needed, how long it will be retained, and what the organisation's breach history looks like. Where a service offers alternative verification methods—such as a third-party identity verification layer that does not store the raw image—that option is worth preferring.
Your network traffic, your browsing habits, your IP address—these are things you can protect with reasonable technical measures. A VPN, for instance, prevents your ISP and network observers from logging your activity, and PremierVPN's strict no-logs policy means there is no retained record of what you did while connected. You can run an IP leak test to verify your connection is clean. These are real, addressable risks with technical solutions.
But a passport scan already submitted to a third party is outside your control the moment you send it. The only leverage you have is at the point of decision—before you submit.
The Takeaway
The DigiCert breach is not primarily a story about a certificate authority's core systems being compromised—they were not. It is a story about what happens when peripheral systems holding sensitive data are treated as lower-priority infrastructure, and about the asymmetric consequences when that data includes documents that cannot simply be invalidated.
If you have received a notification from DigiCert, act on it now rather than waiting to see whether anything materialises. The risks from an exposed passport are long-horizon by nature, and early action—reporting to the relevant authorities, registering a fraud notice, increasing monitoring—significantly reduces the window in which that information is actionable for someone with bad intentions.
More broadly, this is a useful moment to audit which services hold copies of your identity documents and what their data retention policies actually say. It is not a comfortable exercise, but it is a more productive one than changing a password after the fact.
