DigiCert admits 16-month security lapse exposed customer information

DigiCert has admitted that a botched server migration left an internal system exposed to the internet for more than 16 months, allowing an unauthorized user to access customer data, including passports, driver's licenses, and other identity documents. The certificate authority has begun notifying affected customers but has yet to disclose how many people had their information exposed. In an email seen by The Register, DigiCert confirmed the compromised information included names, business email addresses, phone numbers, and business addresses, and said some records may also have contained passports, driver's licenses, utility bills, or other identification documents.

How the exposure happened

DigiCert's incident report traces the blunder back to February 2025, when an internal business system was moved from a VPN-protected network to a different availability zone. That change also opened the system up to the public internet, where it sat for more than 16 months without DigiCert realizing. The archive used the same account management platform as DigiCert's customer-facing products, including a self-registration feature that was never supposed to be available on the internal system. This allowed outsiders to create accounts without multifactor authentication and, thanks to a separate permissions flaw, use them to browse archived customer records.

Timeline of discovery

DigiCert found the unauthorized accounts on June 18, 2026, but initially dismissed them as harmless because they weren't assigned to an application. A security researcher raised the alarm about the account creation issue three days later, but it took until July 2 for DigiCert to shut it down. It wasn't until October 12 that DigiCert began investigating whether customer information had actually been accessed. On October 19, it confirmed that an unauthorized account had accessed a subset of archived records between June 27 and July 2.

Scope and response

DigiCert described the affected records as a 'small proportion' of its archive but hasn't disclosed how many customers or individuals were caught up in the breach. The company did not respond to The Register's questions at the time of publication. DigiCert's postmortem says the server move didn't get a proper security review, monitoring failed to pick up suspicious activity, and the access controls weren't much use against self-registered accounts. The company has since switched off self-registration, tightened network access, and added monitoring. Certificate authority operations, CertCentral, and DigiCert ONE were unaffected, the company said, adding that customer credentials and issued certificates remain secure. It also found no evidence that the unauthorized account had been used to issue, revoke, or validate certificates.

Sources: The Register