DigiCert has admitted that a botched server migration in February 2025 left an internal business system exposed to the public internet for more than 16 months, allowing an unauthorized user to access archived customer data including names, business addresses, and in some cases passports, driver's licenses and other identity documents.
The certificate authority has started notifying affected customers, though it has not disclosed how many people were impacted. In an email seen by The Register, DigiCert said the compromised information included names, business email addresses, phone numbers, and business addresses. Some records may also have contained identification documents such as passports, driver's licenses, or utility bills. DigiCert said it is still reviewing the documents to determine who was affected, adding that it would notify those people once the review was complete.
The incident stemmed from a server migration in February 2025 that moved an internal system from a VPN-protected network to a different availability zone, leaving it accessible from the internet. The system used the same account management platform as DigiCert's customer-facing products, including a self-registration feature intended for other applications. This allowed outsiders to create accounts without multifactor authentication, and a separate permissions flaw let those accounts browse archived customer records in read-only mode.
DigiCert first detected the unauthorized accounts on June 18, 2026, but initially dismissed them because they were not assigned to any application. A security researcher raised the alarm about the account creation issue three days later, but it took until July 2 for DigiCert to shut it down. The company then began investigating whether data had been accessed on October 12, and confirmed on October 19 that an unauthorized account had browsed a subset of records between June 27 and July 2.
"The incident was initially handled as an account-creation issue rather than a data-access event," DigiCert acknowledged in its incident report. The company has since disabled self-registration, tightened network access, and added monitoring. It said certificate authority operations, CertCentral, and DigiCert ONE were unaffected, and that customer credentials and issued certificates remain secure.
Cloud architect Fabian Bader, who shared a copy of his data breach notification on X, wrote: "Thanks @digicert that your data leak was 'limited' to only my full PII data and potentially any verification documents I submitted for my certificate."
Analysis
Why This Matters
- Sensitive identity documents such as passports and driver's licenses were exposed, raising risks of identity theft for affected individuals.
- The breach went undetected for over a year, highlighting gaps in DigiCert's security controls and monitoring.
- As a trusted certificate authority, DigiCert's security incident could affect confidence in the digital certificate ecosystem.
Background
DigiCert is a major certificate authority issuing digital certificates used to secure websites and online communications. This breach involved an internal business system used to archive customer information and identity verification documents, not its core certificate issuance platforms.
Key Perspectives
DigiCert: acknowledged that the incident was initially handled as an account-creation issue rather than a data-access event, and that it failed to detect the data access for months.
Fabian Bader (affected customer): expressed frustration that his personal information and potentially submitted documents were exposed in the breach.
What to Watch
- DigiCert's ongoing review of identification documents to determine the full scope of affected individuals.
- Potential regulatory inquiries or legal actions given the sensitivity of exposed documents.
- Whether DigiCert discloses the number of impacted customers.
Checked
12 claims in this story checked against 2 sources: 12 supported.
Show each claim
- SupportedFabian Bader wrote: “Thanks @digicert that your data leak was 'limited' to only my full PII data and potentially any verification documents I submitted for my certificate.”BleepingComputer: “"Thanks @digicert that your data leak was 'limited' to only my full PII data and potentially any verification documents I submitted for my certificate," Bader wrote .”
- SupportedDigiCert acknowledged: “The incident was initially handled as an account-creation issue rather than a data-access event.”BleepingComputer: “"The incident was initially handled as an account-creation issue rather than a data-access event," DigiCert acknowledged in its report.”
- SupportedDigiCert admitted a 16-month security lapse exposed customer data.www.theregister.com - Articles: “DigiCert admits 16-month security lapse exposed customer information.”
- SupportedA February 2025 server migration left an internal system exposed to the internet for more than 16 months.www.theregister.com - Articles: “DigiCert's incident report traces the blunder back to February 2025, when an internal business system was moved from a VPN-protected network to a different availability zone. That change also opened the system up to the public internet, where it sat for more than 16 months without DigiCert realizing.”
- SupportedAn unauthorized user accessed archived customer data, including names and business addresses and, in some cases, identity documents such as passports and driver's licenses.www.theregister.com - Articles: “In an email seen by The Register, DigiCert confirmed the compromised information included names, business email addresses, phone numbers, and business addresses. Some records may also have contained passports, driver's licenses, utility bills, or other identification documents.”
- SupportedDigiCert began notifying affected customers but has not disclosed how many people were impacted.www.theregister.com - Articles: “The certificate authority has begun notifying affected customers but has yet to disclose how many people had their information exposed.”
- SupportedDigiCert said it was reviewing identification documents to determine who was affected and would notify those people after the review.www.theregister.com - Articles: “"We are completing a review of identification documents to determine the specific individuals involved," DigiCert told those affected, adding that it would notify those people once the review was complete.”
- SupportedThe system shared an account-management platform with customer-facing products; a self-registration feature and a separate permissions flaw let outsiders create accounts without multifactor authentication and browse archived records in read-only mode.BleepingComputer: “Although these accounts weren't assigned to any particular application, an authorization flaw let them access archived customer information in read-only mode.”
- SupportedDigiCert found unauthorized accounts on June 18, 2026, and initially dismissed them because they were not assigned to an application.www.theregister.com - Articles: “DigiCert found the unauthorized accounts on June 18, 2026, but initially dismissed them as harmless because they weren't assigned to an application.”
- SupportedA security researcher raised the account-creation issue three days after June 18, and DigiCert did not shut it down until July 2.www.theregister.com - Articles: “A security researcher raised the alarm about the account creation issue three days later, but it took until July 2 for DigiCert to shut it down.”
- SupportedDigiCert began investigating data access on October 12 and confirmed on October 19 that an unauthorized account accessed a subset of archived records between June 27 and July 2.www.theregister.com - Articles: “It wasn't until October 12 that DigiCert began investigating whether customer information had actually been accessed. On October 19, it confirmed that an unauthorized account had accessed a subset of archived records between June 27 and July 2.”
- SupportedDigiCert said its certificate authority operations, CertCentral and DigiCert ONE were unaffected, and that customer credentials and issued certificates remain secure.www.theregister.com - Articles: “Certificate authority operations, CertCentral, and DigiCert ONE were unaffected, the company said, adding that customer credentials and issued certificates remain secure.”
