DigiCert Confirms Data Breach of Archived Customer Records via Misconfigured Internal System
DigiCert disclosed a data breach affecting an internal archived-customer-data system after a February 2025 infrastructure migration accidentally exposed a self-service registration endpoint to the internet. The exposed endpoint, inherited from an account management platform, allowed creation of non-employee accounts that bypassed MFA and received default read-only permissions, inadvertently granting access to archived customer records. Unauthorized data access was later confirmed to have occurred between June 27 and July 2, 2026, though the issue was initially misdiagnosed as an account-creation problem rather than a data-access event. DigiCert confirmed the reportable breach on October 19, 2026; compromised data primarily included business contact details (names, emails, phone numbers, addresses), with a small subset of accounts also exposing identity documents such as passports, driver's licenses, and utility bills. DigiCert's certificate authority services — including CertCentral, DigiCert ONE, customer login credentials, and issued certificates — were not affected, and no certificate issuance, validation, or revocation activity was impacted.
Entenda a falha
A vulnerabilidade
This is a misconfiguration and authorization flaw in DigiCert's internal archived-customer-data system, not a CVE. A February 2025 migration moved it from a VPN-restricted segment to a publicly reachable availability zone, which exposed a self-service registration endpoint inherited from an account management platform. Anyone who could reach the endpoint could create a non-employee account without MFA. The account got default read-only permissions that allowed access to archived customer records. DigiCert's CertCentral, DigiCert ONE, customer logins and issued certificates were not affected. The fix was an authorization patch deployed July 2, 2026. No version numbers are given.
Como funciona
The archived-data system ran its own account manager instances, separate from customer-facing products. Employees logged in with MFA. After the migration, a request to the exposed registration flow created an account that was not assigned to any application. Because MFA was tied to application assignment, these accounts skipped it. The system still gave them default read-only permissions, so they could retrieve archived files. The failure was at the authorization step: an account with no application was treated as a valid user with data access instead of being rejected.
Por que é vulnerável
The root cause was a cloud migration without adequate security review, which dropped the network restriction that had been protecting an endpoint that was never meant to be public. The authorization model also did not anticipate self-registration abuse. It gave default read access to accounts with no application assignment and did not enforce MFA for them. DigiCert also cites insufficient account-activity monitoring. Its team spotted the odd accounts on June 18, 2026, but wrongly concluded that unassigned accounts could not read data. The patch makes the system reject accounts without application assignments with HTTP 401. As the article notes, restricting network access does not replace permission checks on individual endpoints.
Como foi descoberta
DigiCert's internal team first noticed non-employee accounts on June 18, 2026, but misjudged the risk. A WAF blocked new registrations through the external path. A managed security research program then reported the registration flaw on June 21, which triggered further investigation. Investigators established that unauthorized data access occurred between June 27 and July 2, 2026, and the authorization patch went in on July 2. DigiCert first treated the case as an account-creation problem rather than a data-access event, and confirmed the reportable breach on October 19. The disclosure came through DigiCert's incident report.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 08:17.
Detalhes técnicos
The root cause was a cloud migration that moved the archived-data system from a VPN-restricted network segment to a publicly accessible availability zone, exposing a self-service registration endpoint. Accounts created through this flow were not assigned to applications and thus were not subject to MFA, yet still received default read-only access permitting data retrieval. DigiCert's internal team first noticed non-employee accounts on June 18, 2026, but wrongly assessed that unassigned accounts could not access data. A WAF blocked new registrations via the external path, and a managed security research program reported the registration flaw on June 21, triggering further investigation. An authorization patch deployed July 2, 2026 began rejecting unassigned accounts with HTTP 401 responses, effectively closing the gap. DigiCert attributes the incident to inadequate security review during migration, insufficient account-activity monitoring, and an authorization model that did not anticipate self-registration abuse.
Remediação
DigiCert disabled self-registration, moved remaining endpoints behind private-IP load balancers, reset business-system passwords, and added file-access alerting. Final exposure auditing and account-monitoring reviews were scheduled for November 6, 2026 and remain ongoing.
Linha do tempo
-
DigiCert Confirms Data Breach of Archived Customer Records via Misconfigured Internal System
ler a análise desta fonte ocultar
DigiCert disclosed a data breach affecting an internal archived-customer-data system after a February 2025 infrastructure migration accidentally exposed a self-service registration endpoint to the internet. The exposed endpoint, inherited from an account management platform, allowed creation of non-employee accounts that bypassed MFA and received default read-only permissions, inadvertently granting access to archived customer records. Unauthorized data access was later confirmed to have occurred between June 27 and July 2, 2026, though the issue was initially misdiagnosed as an account-creation problem rather than a data-access event. DigiCert confirmed the reportable breach on October 19, 2026; compromised data primarily included business contact details (names, emails, phone numbers, addresses), with a small subset of accounts also exposing identity documents such as passports, driver's licenses, and utility bills. DigiCert's certificate authority services — including CertCentral, DigiCert ONE, customer login credentials, and issued certificates — were not affected, and no certificate issuance, validation, or revocation activity was impacted.
Technical Details
The root cause was a cloud migration that moved the archived-data system from a VPN-restricted network segment to a publicly accessible availability zone, exposing a self-service registration endpoint. Accounts created through this flow were not assigned to applications and thus were not subject to MFA, yet still received default read-only access permitting data retrieval. DigiCert's internal team first noticed non-employee accounts on June 18, 2026, but wrongly assessed that unassigned accounts could not access data. A WAF blocked new registrations via the external path, and a managed security research program reported the registration flaw on June 21, triggering further investigation. An authorization patch deployed July 2, 2026 began rejecting unassigned accounts with HTTP 401 responses, effectively closing the gap. DigiCert attributes the incident to inadequate security review during migration, insufficient account-activity monitoring, and an authorization model that did not anticipate self-registration abuse.
Remediation
DigiCert disabled self-registration, moved remaining endpoints behind private-IP load balancers, reset business-system passwords, and added file-access alerting. Final exposure auditing and account-monitoring reviews were scheduled for November 6, 2026 and remain ongoing.