"We are completing a review of identification documents to determine the specific individuals involved," DigiCert told those affected, adding that it would notify those people once the review was complete.
How a February 2025 server move left an archive exposed for more than 16 months
DigiCert traces the incident to a server migration in February 2025. An internal business system was moved from a VPN‑protected network to a different availability zone, and that change opened the system to the public internet. According to DigiCert's account, the exposed archive remained reachable for more than 16 months before the company realized it had been internet‑accessible.
Self-registration, shared account platform and a permissions flaw
The archive used the same account management platform as DigiCert's customer‑facing products and — crucially — included a self‑registration feature that "was never supposed to be available on the internal system." That misconfiguration allowed outsiders to create accounts without multifactor authentication. A separate permissions flaw then permitted those self‑registered accounts to browse archived customer records.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDetection, researcher alert and the staggered response timeline
DigiCert says it discovered the unauthorized accounts on June 18, 2026, but initially dismissed them as harmless because the accounts "weren't assigned to an application." A security researcher raised the alarm about the account creation issue three days later, on June 21, and DigiCert shut down self‑registration on July 2. DigiCert confirmed on October 19 that an unauthorized account had accessed a subset of archived records between June 27 and July 2. The company did not begin investigating whether customer information had actually been accessed until October 12.
What data was exposed and what DigiCert says is still secure
In an email seen by The Register, DigiCert confirmed the compromised information included names, business email addresses, phone numbers, and business addresses. Some records "may also have contained passports, driver's licenses, utility bills, or other identification documents," the company told affected customers. DigiCert described the affected records as a "small proportion" of its archive but has not disclosed how many customers or individuals were affected.
DigiCert reported that certificate authority operations, CertCentral, and DigiCert ONE were unaffected. It added that customer credentials and issued certificates "remain secure" and that it found no evidence the unauthorized account had been used to issue, revoke, or validate certificates. The company has since switched off self‑registration, tightened network access, and added monitoring it said might have detected the activity earlier.
How technologists, procurement teams and end users are likely to react
- Technologists and security teams — will note the combination of a misrouted migration, lack of a security review, weak monitoring, and permissive account rules; they will likely audit account management platforms and network segregation to avoid self‑registration on internal systems.
- Affected enterprises and procurement leaders — will press vendors for clearer incident metrics and proofs of remediation, since DigiCert has not disclosed the number of customers or individuals whose documents were exposed and says it is still reviewing identification documents.
- End users and individuals who provided identity documents — will be waiting for the promised notifications; DigiCert said it will notify specific people once its review of identification documents is complete.
The postmortem reads as a sequence of missed guardrails: a migration that didn't get a proper security review, monitoring that failed to pick up suspicious activity, and access controls that offered little protection once self‑registration landed on an internal archive. DigiCert has taken immediate corrective steps — turning off self‑registration, tightening network access, and adding monitoring — but critical questions remain unanswered in public: how many people were affected, which records contained sensitive identity documents, and whether the company's earlier assessments about certificate integrity will satisfy customers demanding transparency.
Read the original report: The Register — DigiCert admits 16-month security lapse exposed customer information
