DigiCert Data Breach: Misconfigured Server Exposes Customer PII and Identity Documents
DigiCert, a major certificate authority, disclosed a data breach stemming from a February 2025 server migration that mistakenly exposed an internal business system—previously restricted to VPN access—to the public internet. The exposed system included a self-registration feature meant for other applications, and an authorization flaw allowed externally created, unassigned accounts to gain read-only access to archived customer data. Exposed information includes names, business email addresses, phone numbers, business addresses, and for some customers, identity documents such as driver's licenses, passports, and utility bills. DigiCert initially discovered unauthorized accounts in June 2026 but misjudged the risk, treating it as an account-creation issue rather than a data-access event; a later investigation confirmed unauthorized access to customer data occurred between June 27 and July 2, 2026. DigiCert states its CertCentral, DigiCert ONE, and core certificate authority services were not compromised, and that login credentials and issued certificates remain secure.
Entenda a falha
A vulnerabilidade
No CVE was assigned. This is a misconfiguration combined with an authorization flaw in an internal DigiCert business system. A February 2025 server migration exposed the system to the internet, though it had been reachable only over VPN. Its self-registration feature, meant for other applications, let external users create accounts, and an authorization flaw let those unassigned accounts read archived customer data. An attacker needed only network reach and the ability to register an account. They got read-only access to names, business emails, phones, addresses and, for some customers, identity documents such as driver's licenses, passports and utility bills. DigiCert says CertCentral, DigiCert ONE and the core CA services were not compromised. No product versions are given.
Como funciona
After the migration, the internal system could be reached from the public internet instead of only through the VPN. An outside user could use its self-registration feature to create an account. That account was not assigned to any application, and the system should have treated it as having no data access. Instead, the authorization logic let such unassigned accounts query archived customer records in read-only mode. The access went wrong at that step, because account creation was treated as harmless while the data-access check was missing or too permissive.
Por que é vulnerável
There were two root causes. First, the server migration silently dropped the VPN-only restriction, so an internal system became internet-facing. Second, an authorization flaw let accounts with no application assignment read archived customer data, and self-registration was open to outsiders. DigiCert also initially treated the incident as an account-creation issue rather than a data-access event, so it did not notice for months that archived data had been read. The fix restricted access to the system, disabled self-registration and added access controls.
Como foi descoberta
DigiCert first found unauthorized accounts on the exposed system in June 2026 but judged they could not reach customer data because they were not assigned to an application. It then received a report through its managed security research program warning that external users could create accounts. It deployed fixes to restrict access and address the authorization flaw, without realizing archived data had already been read. A further investigation on October 19, 2026 confirmed that an unauthorized account accessed customer information between June 27 and July 2, 2026. DigiCert described this in an incident report on Mozilla's Bugzilla and began notifying customers.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 14:16.
Detalhes técnicos
The root cause was a misconfiguration during a server migration that removed VPN-only access restrictions, combined with an authorization flaw in a self-registration feature. This allowed unauthorized accounts—though not tied to any specific application—to access archived customer records in read-only mode. The flaw was reported to DigiCert via its managed security research program, but the company did not realize archived data had already been accessed until a further investigation on October 19, 2026.
Remediação
DigiCert has restricted access to the affected system, disabled the self-registration feature, added additional access controls, and begun sending breach notifications to affected customers. The company says it is still reviewing identification documents to determine the full scope of affected individuals and will provide further notifications once that review is complete.
Linha do tempo
-
DigiCert Data Breach: Misconfigured Server Exposes Customer PII and Identity Documents
ler a análise desta fonte ocultar
DigiCert, a major certificate authority, disclosed a data breach stemming from a February 2025 server migration that mistakenly exposed an internal business system—previously restricted to VPN access—to the public internet. The exposed system included a self-registration feature meant for other applications, and an authorization flaw allowed externally created, unassigned accounts to gain read-only access to archived customer data. Exposed information includes names, business email addresses, phone numbers, business addresses, and for some customers, identity documents such as driver's licenses, passports, and utility bills. DigiCert initially discovered unauthorized accounts in June 2026 but misjudged the risk, treating it as an account-creation issue rather than a data-access event; a later investigation confirmed unauthorized access to customer data occurred between June 27 and July 2, 2026. DigiCert states its CertCentral, DigiCert ONE, and core certificate authority services were not compromised, and that login credentials and issued certificates remain secure.
Technical Details
The root cause was a misconfiguration during a server migration that removed VPN-only access restrictions, combined with an authorization flaw in a self-registration feature. This allowed unauthorized accounts—though not tied to any specific application—to access archived customer records in read-only mode. The flaw was reported to DigiCert via its managed security research program, but the company did not realize archived data had already been accessed until a further investigation on October 19, 2026.
Remediation
DigiCert has restricted access to the affected system, disabled the self-registration feature, added additional access controls, and begun sending breach notifications to affected customers. The company says it is still reviewing identification documents to determine the full scope of affected individuals and will provide further notifications once that review is complete.