DigiCert admits 16-month security lapse exposed customer information

DigiCert says a botched server migration exposed an internal business system to the public internet for more than 16 months, creating a path to archived customer records. In February 2025, the system was moved out of a VPN-protected network without an adequate security review. It shared an account platform with customer-facing services, and a self-registration feature - meant to be unavailable internally - let outsiders create accounts without multifactor authentication. A permissions flaw then allowed those accounts to browse archived records. The exposed information included names, business email addresses, phone numbers, and business addresses; some records also held passports, driver’s licenses, utility bills, or other identity documents.

DigiCert found unauthorized accounts on June 18, 2026, but initially considered them harmless. A researcher raised concerns three days later, and the company disabled self-registration on July 2. It did not investigate whether records had been accessed until October; it then confirmed that an unauthorized account viewed a subset of archived records between June 27 and July 2. DigiCert calls the affected portion small but has not said how many people were involved, and is still identifying people whose documents may have been exposed. The company says its certificate services, credentials, and issued certificates were unaffected, with no evidence of certificate misuse. It has tightened network access, disabled self-registration, and added monitoring.