DigiCert discloses breach of archived business customer data via exposed system and self-registration flaw
DigiCert disclosed a data breach affecting archived business customer information. An internal archive system was moved to a different network segment in February 2025 and was inadvertently exposed to the internet. Attackers abused a self-registration feature in the system's account manager, which did not require MFA. They created a read-only account that could reach archived data between June 27 and July 2. DigiCert blocked the account on July 2. At first it treated the event as an account-creation incident. On October 12 it began suspecting data access, and it determined in October that the account had been used to read archived customer data. The data included names, email addresses, phone numbers and business addresses. In some cases it also included customer-provided documents such as driver's licenses, passports and utility bills. DigiCert has not said how many customers were affected. The article does not attribute the intrusion to any actor.
Entenda a falha
A vulnerabilidade
No CVE was assigned. An internal DigiCert business archive system was moved to a different network segment in February 2025 and was inadvertently exposed to the internet. Its account manager had a self-registration feature, built for other purposes, that did not require MFA. An attacker with only network reach could create a read-only account and read archived customer data between June 27 and July 2. DigiCert says the account could not write records, approve validations or issue certificates. No affected or fixed versions apply; the fix was a configuration and access change.
Como funciona
The archive system holds customer information for business customers. After the February 2025 migration to another network segment, it became reachable from the internet. Anyone reaching its account manager could use the self-registration feature, which did not ask for MFA, to create an account. That account was granted read-only access to archived data, and it was used to read customer contact details and, in some cases, submitted documents. DigiCert blocked the account on July 2.
Por que é vulnerável
The root cause was a configuration and exposure failure. The network segment migration left the system internet-facing without anyone noticing, and a self-registration feature meant for other purposes remained active with no MFA, so an outsider could obtain an account with archive access. Ownership of the system and enforcement of its permission policies also had to be verified afterward, which suggests they were not properly maintained. DigiCert has since disabled self-registration, reset passwords for all business system users and added monitoring.
Como foi descoberta
DigiCert first investigated and remediated the event as an account-creation incident after blocking the account on July 2. On October 12 it began suspecting the account had accessed archived data, and in October it determined that it had been used to read customer contact information. The articles do not say who found the exposure, how many customers were affected, or who the attacker was. SecurityWeek reported the disclosure and asked DigiCert for more information.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:18.
Detalhes técnicos
- Root cause: a network segment migration (February 2025) left the archive system internet-exposed. A self-registration feature built for other purposes, with no MFA, allowed creation of an account with read-only access to archived data.
- DigiCert says the access could not write records, act as a validation approver or issue certificates. CA systems run on separate network segments and were not affected (securityweek.com).
Remediação
Since mid-October DigiCert has added monitoring and alerting. It verified or removed remaining non-DigiCert accounts and reset passwords for all business system users. It disabled self-registration and verified ownership of the system and enforcement of its permission policies.
Linha do tempo
-
DigiCert discloses breach of archived business customer data via exposed system and self-registration flaw
ler a análise desta fonte ocultar
DigiCert disclosed a data breach affecting archived business customer information. An internal archive system was moved to a different network segment in February 2025 and was inadvertently exposed to the internet. Attackers abused a self-registration feature in the system's account manager, which did not require MFA. They created a read-only account that could reach archived data between June 27 and July 2. DigiCert blocked the account on July 2. At first it treated the event as an account-creation incident. On October 12 it began suspecting data access, and it determined in October that the account had been used to read archived customer data. The data included names, email addresses, phone numbers and business addresses. In some cases it also included customer-provided documents such as driver's licenses, passports and utility bills. DigiCert has not said how many customers were affected. The article does not attribute the intrusion to any actor.
Technical Details
- Root cause: a network segment migration (February 2025) left the archive system internet-exposed. A self-registration feature built for other purposes, with no MFA, allowed creation of an account with read-only access to archived data.
- DigiCert says the access could not write records, act as a validation approver or issue certificates. CA systems run on separate network segments and were not affected (securityweek.com).
Remediation
Since mid-October DigiCert has added monitoring and alerting. It verified or removed remaining non-DigiCert accounts and reset passwords for all business system users. It disabled self-registration and verified ownership of the system and enforcement of its permission policies.