DigiCert Exposes Business Customer Data After Mis‑Configured System Migration
What Happened — DigiCert, a global certificate authority, disclosed that an internal business system was unintentionally moved out of its VPN‑restricted network in February 2025. The change turned the system into an externally reachable endpoint, and an unassigned account was created without proper alerting. Between June 27 and July 2 2026 the exposed database was accessed by an external actor. The accessed records contained customer names, business email addresses, phone numbers and scanned identity documents (driver’s licenses, passports, utility bills). DigiCert reported that the breach did not affect its certificate‑issuing services, nor were customer login credentials taken. The company fixed the exposure on July 2 and has involved law‑enforcement.
Why It Matters for Trust & Control Assurance — The incident highlights the need for continuous monitoring of account‑creation events and rigorous change‑management oversight—control objectives that underpin vendor‑risk assurance across many frameworks.
Who Is Affected — Enterprises that rely on DigiCert’s PKI services, SaaS providers, and any organization that stores personal identification documents with third‑party vendors.
Recommended Actions
- Review third‑party change‑management and configuration‑review processes.
- Implement real‑time alerting for new account creation on external‑facing assets.
- Collect and retain evidence of access‑control monitoring to satisfy audit requirements.
Source: The Record
Technical Notes
- Attack vector: misconfiguration of network segmentation and insufficient alerting.
- No CVE associated; the flaw was procedural rather than software‑level.
- Data types: personally identifiable information (names, emails, phone numbers, scanned IDs).
Source: The Record