DigiCert admits 16-month security lapse exposed customer information
Botched server move left the door open, and DigiCert took months to notice someone had wandered in
DigiCert disclosed a security lapse that exposed customer data for more than a year, including passports, driver's licenses, and other identification documents. The company admitted the breach occurred after a server migration in February 2025, which exposed an internal system to the internet. An unauthorized user accessed customer data, including names, business email addresses, phone numbers, and business addresses.
DigiCert initiated a review to identify the specific individuals affected and notified those impacted once the review was complete. The incident began with the movement of an internal business system to a different availability zone in February 2025, creating a vulnerability that allowed outsiders to create accounts without multifactor authentication.
DigiCert discovered the unauthorized accounts on June 18, 2026, but mistakenly dismissed them as harmless due to lack of application assignment. A security researcher alerted the company about the issue three days later, leading to the shutdown of the accounts on July 2. However, unauthorized access to a subset of archived records occurred between June 27 and July 2.
DigiCert acknowledged that the affected records constituted a small proportion of its archive but did not disclose the exact number of customers or individuals impacted. The company has since restricted self-registration, enhanced network access controls, and implemented additional monitoring to prevent similar incidents. Certificate operations, including the issuance and validation of certificates, remained unaffected by the breach.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
