Alerts and updates
-
04/08/2019
DocuSign is proceeding with our scheduled Single Sign-On certificate replacement plan. DocuSign is already issuing authentication requests with the new certificate in all environments. Next, DocuSign will no longer accept SAML responses encrypted with the old certificate in all environments starting April 11th, 2019 at 4:00 PM PST.
Please review if your Identity Provider (IdP) has enabled SAML encryption. If your IdP uses a DocuSign certificate to encrypt SAML responses, you must replace the old certificate with the new certificate found here: https://www.docusign.com/trust/compliance/public-certificates. Failing to update this certificate will not allow a user to log into DocuSign. If you are unsure how to complete these steps please contact your IdP.
-
04/04/2019
DocuSign has observed a new phishing campaign that began around noon of April 4th (Pacific Time). The email purports to come from "DocuSign Electronic Signature” using the email address "docusign@buyapetfranchise.com". The emails have the subject line similar to:
"You received notification from DocuSign Service“
These emails contain links to a malicious Word document which, if run, will download malware to your computer. These emails are not sent from DocuSign. Do not click on the link in these emails, instead please forward them to spam@docusign.com and then delete the email immediately.
For more information on how to spot phishing please see our Combating Phishing white paper (3.3 MB)
-
04/02/2019
DocuSign has observed a new phishing campaign that began the morning of April 2nd (Pacific Time). The email purports to come from "DocuSign Electronic Signature” using the email address "docusign@milaromanoff.com". The emails have the subject line similar to:
"You received invoice from DocuSign Electronic Signature Service“
These emails contain links to a malicious Word document which, if run, will download malware to your computer. These emails are not sent from DocuSign. Do not click on the link in these emails, instead please forward them to spam@docusign.com and then delete the email immediately.
For more information on how to spot phishing please see our Combating Phishing white paper (3.3 MB) https://www.docusign.com/sites/default/files/Combating_Phishing_WP_05082...
-
03/01/2019
In January this year, DocuSign patched its online digital signature validation tool (validator.docusign.com) to ensure it could address the three digital signature vulnerabilities identified in a research paper by a team from Ruhr-University Bochum in Germany.
Those vulnerabilities related to online validation services in general—they had no impact on the integrity or validity of a digital signature written to a document by the core DocuSign eSignature solution. In addition, given DocuSign had already patched the validator tool before the research paper was published, we have asked the researchers to update their online records accordingly.
-
02/28/2019On Monday March 4th, 2019 at approximately 4:00 PM PST DocuSign will replace their Single Sign-On certificate and simultaneously change the CA in all production environments. At that time DocuSign will only sign outbound SAML requests with a single certificate, the new certificate. Please take immediate action to update the SSO certificate and/or metadata URL within your IdP application as needed to prevent user login issues. If you are unsure how to complete these steps please contact your IdP.
-
02/14/2019
DocuSign has observed a new phishing campaign that began the morning of February 14th (Pacific Time). The email purports to come from "DocuSign Electronic Signature” using the email address "docusign@srcpro.com". The emails all have the subject:
"You received invoice from DocuSign Electronic Signature Service“
These emails contain links to a malicious Word document or Microsoft Excel Spreadsheet which, if run, will download malware to your computer. These emails are not sent from DocuSign. Do not click on the link in these emails, instead please forward them to spam@docusign.com and then delete the email immediately.
For more information on how to spot phishing please see our Combating Phishing white paper (3.3 MB).
-
01/22/2019The DocuSign SSO certificate is expiring. The renewal schedule has been posted here:https://www.docusign.com/trust/compliance/public-certificates
-
01/14/2019
DocuSign has observed a new phishing campaign that began the morning of January 14th (Pacific Time). The email purports to come from "DocuSign Signature and Invoice Service" using the email address docusign@alzeyexpress.com. The emails all have the subject:
"You received / got invoice from DocuSign Signature Service / DocuSign Electronic Signature Service / DocuSign Service"
These emails contain links to a malicious Word document or Microsoft Excel Spreadsheet which, if run, will download malware to your computer. These emails are not sent from DocuSign. Do not click on the link in these emails, instead please forward them to spam@docusign.com and then delete the email immediately.
For more information on how to spot phishing please see our Combating Phishing white paper (3.3 MB).
-
01/02/2019
The DocuSign Site certificates for Demo and EU are expiring. The renewal schedule has been posted here:https://www.docusign.com/trust/compliance/public-certificates
-
12/17/2018
DocuSign has observed a new phishing campaign that began the morning of December 17th (Pacific Time). The email purports to come from "DocuSign Signature and Invoice Service" using the email address docusign@hybels.com. The emails all have the subject:
"You received / got invoice from DocuSign Signature Service / DocuSign Electronic Signature Service / DocuSign Service"
These emails contain links to a malicious Word document or Microsoft Excel Spreadsheet which, if run, will download malware to your computer. These emails are not sent from DocuSign. Do not click on the link in these emails, instead please forward them to spam@docusign.com and then delete the email immediately.
For more information on how to spot phishing please see our Combating Phishing white paper (3.3 MB).
-
12/10/2018
DocuSign has observed a new phishing campaign that began the morning of December 10th (Pacific Time). The email purports to come from "DocuSign Signature and Invoice Service" using the email address docusign@qualitybumper.com. The emails all have the subject:
"You received / got invoice from DocuSign Signature Service / DocuSign Electronic Signature Service / DocuSign Service"
These emails contain links to a malicious Word document which, if run, will download malware to your computer. These emails are not sent from DocuSign. Do not click on the link in these emails, instead please forward them to spam@docusign.com and then delete the email immediately.
For more information on how to spot phishing please see our Combating Phishing white paper (3.3 MB).
-
11/29/2018
DocuSign has observed a new phishing campaign that began the morning of November 29th (Pacific Time). The email purports to come from "DocuSign Signature and Invoice Service" using the email address docusign@jeffhartmd.com. The emails all have the subject:
"You received / got invoice from DocuSign Signature Service / DocuSign Electronic Signature Service / DocuSign Service"
These emails contain links to a malicious Word document which, if run, will download malware to your computer. These emails are not sent from DocuSign. Do not click on the link in these emails, instead please forward them to spam@docusign.com and then delete the email immediately.
For more information on how to spot phishing please see our Combating Phishing white paper (3.3 MB).