DigiCert Migration Misconfiguration Exposes Customer Identity Documents
What Happened — In February 2025 DigiCert moved an internal archive containing customer business and personal data from a VPN‑protected zone to a publicly reachable network segment as part of a system migration. The change was performed without a security impact review, unintentionally exposing an account‑registration endpoint to the Internet. Because the newly created accounts were not required to use multifactor authentication and were granted read‑only access, an external actor was able to register an account, browse the archive, and download records that included names, business emails, phone numbers, addresses, and identity‑verification documents (driver’s licences, passports, utility bills). The intrusion was first detected in June 2026 by a managed‑security program, fully understood a few days later, and mitigated in July 2026 by placing the archive behind a web‑application firewall, blocking external account creation, and adding SIEM alerts for blocked attempts.
Why It Matters for Trust & Control Assurance — The incident highlights the need for robust access‑control policies (MFA, least‑privilege) and formal change‑management reviews to protect data‑handling assets.
Who Is Affected — Certificate authorities, PKI service providers, SaaS platforms handling customer identity data, and any organization that exposes internal services without proper authentication.
Recommended Actions
- Conduct a post‑migration security review of all network‑exposed assets and enforce MFA on any account‑creation pathways.
- Map the access‑control gap to your audit framework (e.g., NIST CSF “Protect” function) and collect continuous evidence of enforcement.
Technical Notes – Attack vector: network‑zone misconfiguration combined with unauthenticated account creation. No CVE was involved. Exfiltrated data types: personal identifiers, business contact information, and government‑issued ID scans. Source: DataBreachToday