DigiCert discloses 16-month exposure of internal archive after server migration; ID documents of customers accessed
DigiCert has disclosed that an internal business system holding archived customer records was exposed to the internet for more than 16 months after a February 2025 migration. The migration moved it from a VPN-protected network to a different availability zone. An unauthorized account accessed a subset of archived records between June 27 and July 2, 2026. The exposed data includes names, business email addresses, phone numbers and business addresses. Some records also held passports, driver's licenses, utility bills and other ID documents. DigiCert has not said how many people are affected, and it calls the affected records a "small proportion" of the archive.
Entenda a falha
A vulnerabilidade
This is not a product CVE. It is a misconfiguration and access-control failure in a DigiCert internal archive system. After a February 2025 migration it was reachable from the internet, and it ran the same account management platform as DigiCert's customer products, including a self-registration feature that should never have been enabled there. An outsider could create an account without multifactor authentication, and a separate permissions flaw let that account browse archived customer records. Those records held names, business contacts and, in some cases, passports, driver's licenses and utility bills. No affected or fixed versions are given. CA operations, CertCentral and DigiCert ONE were not affected.
Como funciona
In February 2025 the internal business system was moved from a VPN-protected network to a different availability zone, which exposed it to the public internet. Because it ran the customer-facing account platform, its self-registration function was reachable. An outsider could register an account with no MFA. Once logged in, the account was not properly restricted by permissions, so it could list and read archived customer records. According to DigiCert, one unauthorized account read a subset of the archive between June 27 and July 2, 2026.
Por que é vulnerável
The postmortem points to several failures. The migration got no proper security review, so the network exposure went unnoticed. Self-registration, meant only for customer-facing products, was left active on the internal system. A separate permissions flaw let self-registered accounts see archived data. Monitoring did not detect the suspicious activity. DigiCert also found unauthorized accounts on June 18, 2026 and dismissed them as harmless because they were not assigned to an application. The fix was to disable self-registration, tighten network access and add monitoring.
Como foi descoberta
DigiCert found unauthorized accounts on June 18, 2026 but dismissed them. A security researcher raised the account-creation issue three days later, and the exposure was shut down on July 2. DigiCert began investigating actual data access on October 12 and confirmed on October 19 that an unauthorized account had read archived records. It then began notifying customers, and The Register reported it on November 6 based on DigiCert's incident report and an email to affected customers. The number of people affected has not been disclosed.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:18.
Detalhes técnicos
- The archive ran on the same account management platform as DigiCert's customer-facing products. That platform includes a self-registration feature that was never meant to be available on the internal system.
- Outsiders could create accounts without multifactor authentication. A separate permissions flaw let those accounts browse archived records.
- DigiCert found unauthorized accounts on June 18, 2026 and dismissed them as harmless because they were not assigned to an application. A security researcher raised the account creation issue three days later. The exposure was shut down on July 2.
- DigiCert began investigating actual data access on October 12 and confirmed it on October 19.
- The postmortem cites a missing security review of the migration and monitoring that failed to detect the activity.
- DigiCert says certificate authority operations, CertCentral and DigiCert ONE were unaffected. It also says customer credentials and issued certificates remain secure, and it found no evidence of certificate issuance, revocation or validation by the unauthorized account (theregister.com).
Remediação
- DigiCert has disabled self-registration, tightened network access and added monitoring.
- DigiCert is notifying affected customers and is still reviewing identification documents to identify the individuals involved.
Linha do tempo
-
DigiCert discloses 16-month exposure of internal archive after server migration; ID documents of customers accessed
ler a análise desta fonte ocultar
DigiCert has disclosed that an internal business system holding archived customer records was exposed to the internet for more than 16 months after a February 2025 migration. The migration moved it from a VPN-protected network to a different availability zone. An unauthorized account accessed a subset of archived records between June 27 and July 2, 2026. The exposed data includes names, business email addresses, phone numbers and business addresses. Some records also held passports, driver's licenses, utility bills and other ID documents. DigiCert has not said how many people are affected, and it calls the affected records a "small proportion" of the archive.
Technical Details
- The archive ran on the same account management platform as DigiCert's customer-facing products. That platform includes a self-registration feature that was never meant to be available on the internal system.
- Outsiders could create accounts without multifactor authentication. A separate permissions flaw let those accounts browse archived records.
- DigiCert found unauthorized accounts on June 18, 2026 and dismissed them as harmless because they were not assigned to an application. A security researcher raised the account creation issue three days later. The exposure was shut down on July 2.
- DigiCert began investigating actual data access on October 12 and confirmed it on October 19.
- The postmortem cites a missing security review of the migration and monitoring that failed to detect the activity.
- DigiCert says certificate authority operations, CertCentral and DigiCert ONE were unaffected. It also says customer credentials and issued certificates remain secure, and it found no evidence of certificate issuance, revocation or validation by the unauthorized account (theregister.com).
Remediation
- DigiCert has disabled self-registration, tightened network access and added monitoring.
- DigiCert is notifying affected customers and is still reviewing identification documents to identify the individuals involved.