DigiCert has disclosed a data breach that it says was caused by a server migration error which unintentionally exposed an internal business system to the internet. According to the company, unauthorised parties were able to access customer information, including identity documents.

For European businesses, the incident is a reminder that even trusted infrastructure and security providers can become a source of operational, privacy and compliance risk when internal systems are misconfigured.

What happened

According to reporting by BleepingComputer, DigiCert said an internal business system was exposed during a server migration, which allowed unauthorised access to customer data. The exposed information reportedly included customer information and identity documents.

Based on the information available, the breach appears to be linked to a configuration or deployment mistake rather than a newly disclosed software vulnerability. DigiCert’s role as a digital trust provider makes the incident notable because many businesses use such providers for certificates, validation processes and other security-related services.

Why it matters for European businesses

The immediate issue is not only the breach itself, but the type of data involved. Identity documents can create elevated risk because they may be used in fraud, impersonation attempts, social engineering or follow-on attacks against affected organisations and individuals.

For European companies, the case highlights several practical concerns:

• Third-party security risk: Businesses often depend on external providers for certificates, verification and trust services. A breach at one supplier can create downstream exposure for customers.
• Privacy and compliance implications: If employee, administrator or company identity records were shared with a vendor and later exposed, organisations may need to assess internal reporting, contractual and regulatory implications depending on the circumstances.
• Higher phishing and impersonation risk: Stolen contact data or identification material can make fraudulent emails, support scams or account recovery attacks more convincing.
• Infrastructure trust concerns: Security vendors are part of critical digital supply chains. Incidents affecting them can trigger broader reviews of vendor access, document-sharing practices and identity verification processes.

The available reporting does not indicate that certificate systems themselves were compromised. Businesses should therefore avoid assuming broader technical impact beyond what has been confirmed.

Who may be affected

The organisations most likely to pay attention are those that have submitted identification documents or customer records to DigiCert as part of account, validation or business verification processes.

• Companies using DigiCert certificates or trust services
• IT and security teams responsible for certificate management and vendor assurance
• Regulated businesses that must document supplier risk and personal data exposure
• SMEs and e-commerce firms that rely on external platforms for website security and identity checks
• Founders and operations teams responsible for incident response, procurement and compliance coordination

What companies should consider

Businesses that use DigiCert or similar providers should review what information has been shared with those vendors and whether any internal or personal identity documents were included.

• Check vendor notifications: Review any direct communication from DigiCert to determine whether your organisation was affected and what data categories were involved.
• Assess exposed data: Identify whether company representatives, administrators or employees provided passports, ID cards, business registration documents or other sensitive records.
• Increase phishing awareness: Warn relevant staff to expect more targeted emails, calls or support requests that use real company details.
• Review supplier risk records: Update vendor risk assessments and incident logs where required, especially if the provider is part of security, identity or hosting infrastructure.
• Limit future document sharing: Reassess how identity documents are stored, transmitted and retained by third parties, and whether data minimisation can reduce future exposure.
• Coordinate legal and privacy review: Where personal data linked to staff or representatives may be involved, consider whether GDPR-related assessment, contractual review or internal escalation is necessary.

More broadly, the incident reinforces a common security lesson for European businesses: trusted vendors still need ongoing oversight. Misconfiguration during migration or infrastructure change remains a frequent cause of exposure, including at companies whose services are themselves security-related.