DigiCert Discloses Data Breach Exposing Archived Customer Contact Details and Identity Documents, Begins Customer Notifications
DigiCert confirmed unauthorized access to an internal business system holding archived customer information after a security misconfiguration exposed the application to the internet. The exposure traces back to a February 4, 2025 infrastructure migration that moved the system from a VPN-restricted network segment to an externally accessible availability zone, inadvertently exposing a self-service registration endpoint inherited from an account management platform used elsewhere. DigiCert says its certificate authority services, including CertCentral, DigiCert ONE, customer login credentials, and issued certificates, were not affected, and no certificate issuance, validation, or revocation activity was tied to the unauthorized account. The breach exposed business contact details and, for a small minority of accounts, identity documents such as passports, driver's licenses, or utility bills, though DigiCert has not disclosed an affected-customer count. DigiCert has since begun sending data breach notifications to affected customers, with cloud architect Fabian Bader sharing a copy of his notice on X and criticizing the company's characterization of the leak as "limited" given it included his full PII and potential certificate verification documents (bleepingcomputer.com).
Entenda a falha
A vulnerabilidade
No CVE was assigned. This is a misconfiguration combined with an authorization flaw in an internal DigiCert business system holding archived customer data. A February 4, 2025 migration moved it from a VPN-restricted segment to an externally reachable availability zone, exposing a self-registration endpoint inherited from an account management platform used elsewhere. An attacker needed only network reach and the ability to register an account. Those accounts skipped MFA and got default read-only permissions on archived records: names, business emails, phones, addresses and, for a small minority, passports, driver's licenses or utility bills. DigiCert says CertCentral, DigiCert ONE, login credentials and issued certificates were not affected. No product versions apply.
Como funciona
After the migration, the archived-data system, which runs its own account manager instances, was reachable from the internet instead of only over VPN. An outside user could use the exposed registration flow to create an account. Employees authenticated with MFA, but this flow created accounts with no application assignment, so MFA did not apply to them. The system was expected to treat such accounts as having no data access, but they received default read-only permissions that let them retrieve archived customer records. The failure happened at that authorization step.
Por que é vulnerável
There were two root causes. The migration silently dropped the VPN-only restriction, and the authorization model did not anticipate self-registration, so accounts without application assignment still got read access to archived data. As gbhackers.com notes, network restrictions do not replace permission checks on individual endpoints. DigiCert also cites inadequate security review during migration and insufficient account-activity monitoring, and it first treated the case as an account-creation problem rather than a data-access event. The fix rejects accounts lacking application assignments (HTTP 401), disables self-registration, moves remaining endpoints behind private-IP load balancers and adds file-access alerts.
Como foi descoberta
DigiCert's internal team noticed non-employee accounts on June 18, 2026, but concluded that accounts without an application could not reach data. A web application firewall blocked new registrations through the external path, and on June 21 a managed security research program reported the registration issue, prompting further investigation (brandefense.io says DigiCert verified it on June 24). An authorization patch on July 2 closed the gap, but the event was handled as an account-creation issue. Further investigation confirmed on October 19 that an unauthorized account accessed customer data between June 27 and July 2, 2026. DigiCert described this in an incident report on Mozilla's Bugzilla (brandefense.io dates the posting to November 1) and began notifying customers; the review of identity documents continues.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 19:29.
Detalhes técnicos
Accounts created through the exposed self-registration flow were not assigned to any application and therefore bypassed multifactor authentication, while still receiving default read-only permissions that allowed access to archived customer records. DigiCert's internal team first noticed nonemployee accounts on June 18, 2026, but initially concluded that accounts without assigned applications could not access data. A managed security research program reported the registration issue on June 21, 2026 (verified by DigiCert on June 24, according to brandefense.io), prompting further investigation. Investigators later determined that unauthorized data access occurred between June 27 and July 2, 2026. An authorization patch deployed on July 2 rejected accounts lacking application assignments, returning HTTP 401 responses, but DigiCert initially treated the event as an account-creation problem rather than a confirmed data-access incident, a characterization the company itself acknowledged, stating the incident was "initially handled as an account-creation issue rather than a data-access event" (bleepingcomputer.com). DigiCert did not confirm the reportable breach until October 19, 2026, roughly four months after the unauthorized access window, after further investigation confirmed data had actually been read (bleepingcomputer.com). The full incident report was posted to Mozilla's public CA compliance tracker on November 1, 2026 (brandefense.io). In its customer notification, DigiCert stated the information involved was limited to names, business email addresses, phone numbers, and business addresses, and may have included an identification document such as a driver's license, passport, or utility bill, and said it was still reviewing identification documents to determine which individuals were affected before completing notification of that subset (bleepingcomputer.com).
Remediação
DigiCert disabled self-registration on the affected platform, moved remaining endpoints behind private-IP load balancers, reset business-system passwords, and added file-access alerts. The company identified inadequate security review during migration, insufficient account-activity monitoring, and an authorization model that failed to anticipate self-registration as contributing factors. Final exposure auditing and account-monitoring reviews were scheduled for November 6, 2026, and remain ongoing. DigiCert has restricted access to the affected system and has begun actively sending breach notification letters to affected customers (bleepingcomputer.com).
Linha do tempo
-
DigiCert Begins Notifying Customers Affected by Data Breach Exposing Identity Documents
This article adds that DigiCert has begun actively sending data breach notification letters to affected customers, and includes the notification's exact wording along with a reaction from cloud architect Fabian Bader, who publicly shared his notice on X and criticized the company's characterization of the exposure as 'limited'. It also confirms DigiCert is still reviewing identification documents to determine the full scope of affected individuals before completing notifications.
ler a análise desta fonte ocultar
This article adds that DigiCert has begun actively sending data breach notification letters to affected customers, and includes the notification's exact wording along with a reaction from cloud architect Fabian Bader, who publicly shared his notice on X and criticized the company's characterization of the exposure as 'limited'. It also confirms DigiCert is still reviewing identification documents to determine the full scope of affected individuals before completing notifications.
DigiCert has begun sending data breach notifications to customers affected by an incident in which a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to archived customer information and identity documents. The breach affected a small portion of DigiCert's archived customer data, including names, business email addresses, phone numbers, and business addresses, and for some individuals also exposed personal identification documents such as driver's licenses, passports, and utility bills. Cloud architect Fabian Bader shared a copy of the notification he received on X, writing that his "data leak was 'limited' to only my full PII data and potentially any verification documents I submitted for my certificate." DigiCert says it is still reviewing identification documents to determine which individuals were affected by that part of the exposure and will notify them once that review is complete. The company reiterated that its certificate authority services, CertCentral, and DigiCert ONE platforms were not compromised, and that customer login credentials and issued certificates remain secure.
Technical Details
The exposure traces back to a February 2025 server migration that inadvertently moved an internal business system from a VPN-restricted network to the public internet. The exposed system retained a self-registration feature meant for other applications, letting external users create accounts; an authorization flaw then let those accounts access archived customer information in read-only mode even though they were not assigned to any application. DigiCert first discovered the unauthorized accounts in June 2026 but initially believed they could not access customer data because they lacked application assignments. A report through DigiCert's managed security research program subsequently warned that external users could create accounts on the system, prompting DigiCert to deploy fixes restricting access and correcting the authorization flaw, though it did not yet realize archived data had already been read. Only on October 19 did further investigation confirm an unauthorized account had accessed customer information between June 27 and July 2, 2026; DigiCert acknowledged that "the incident was initially handled as an account-creation issue rather than a data-access event." The unauthorized account had read-only access and could not modify records, approve certificate validations, or issue certificates.
Remediation
DigiCert has restricted access to the affected system, disabled self-registration, and added additional access controls. BleepingComputer has contacted DigiCert for further details, including the total number of affected customers, and will update its reporting if a response is received.
-
DigiCert Discloses Data Breach Exposing Archived Customer Contact Details and Identity Documents
ler a análise desta fonte ocultar
DigiCert confirmed unauthorized access to an internal business system holding archived customer information after a security misconfiguration exposed the application to the internet. The exposure traces back to a February 4, 2025 infrastructure migration that moved the system from a VPN-restricted network segment to an externally accessible availability zone, inadvertently exposing a self-service registration endpoint inherited from an account management platform used elsewhere. DigiCert says its certificate authority services, including CertCentral, DigiCert ONE, customer login credentials, and issued certificates, were not affected, and no certificate issuance, validation, or revocation activity was tied to the unauthorized account. The breach exposed business contact details and, for a small minority of accounts, identity documents such as passports, driver's licenses, or utility bills, though DigiCert has not disclosed an affected-customer count.
Technical Details
Accounts created through the exposed self-registration flow were not assigned to any application and therefore bypassed multifactor authentication, while still receiving default read-only permissions that allowed access to archived customer records. DigiCert's internal team first noticed nonemployee accounts on June 18, 2026, but initially concluded that accounts without assigned applications could not access data. A managed security research program reported the registration issue on June 21, 2026 (verified by DigiCert on June 24, according to brandefense.io), prompting further investigation. Investigators later determined that unauthorized data access occurred between June 27 and July 2, 2026. An authorization patch deployed on July 2 rejected accounts lacking application assignments, returning HTTP 401 responses, but DigiCert initially treated the event as an account-creation problem rather than a confirmed data-access incident. DigiCert did not confirm the reportable breach until October 19, 2026, roughly four months after the unauthorized access window, after further investigation confirmed data had actually been read (bleepingcomputer.com). The full incident report was posted to Mozilla's public CA compliance tracker on November 1, 2026 (brandefense.io).
Remediation
DigiCert disabled self-registration on the affected platform, moved remaining endpoints behind private-IP load balancers, reset business-system passwords, and added file-access alerts. The company identified inadequate security review during migration, insufficient account-activity monitoring, and an authorization model that failed to anticipate self-registration as contributing factors. Final exposure auditing and account-monitoring reviews were scheduled for November 6, 2026, and remain ongoing.