DigiCert Confirms Server Move Left Customer Identity Records Exposed for More Than a Year

DigiCert, a certificate authority, has admitted that a faulty server migration exposed an internal system to the public internet for more than 16 months. According to The Register, the problem began in February 2025, when the system was moved from a VPN-protected network to a different availability zone. An unauthorised user later accessed customer data, which included names, business email addresses, phone numbers and business addresses. Some records may also have held passports, driver's licences, utility bills or other identification documents.

The archive used the same account management platform as DigiCert's customer-facing products. That included a self-registration feature that was never meant to be available on the internal system. Outsiders could create accounts without multifactor authentication and, because of a separate permissions flaw, use them to browse archived customer records.

DigiCert found unauthorised accounts on June 18, 2026, but first dismissed them as harmless because they were not assigned to an application. A security researcher raised the issue three days later, and the company shut it down on July 2. On October 19, DigiCert confirmed that an unauthorised account had accessed a subset of archived records between June 27 and July 2. It calls this a "small proportion" of the archive, has begun notifying customers, and is still reviewing identification documents to identify the individuals involved. It has not said how many people were affected.