DigiCert confirmed unauthorized access to an internal business system containing archived customer information due to a security misconfiguration that exposed the application to the internet.
This incident affected business contact details and, in some cases, identity documents. However, DigiCert said its certificate authority services, including CertCentral, DigiCert ONE, customer login credentials, and issued certificates, were not affected.
According to DigiCert’s incident report, the exposure originated on February 4, 2025, when an infrastructure migration moved the system from a VPN-restricted network segment to an externally accessible availability zone.
The change inadvertently exposed a self-service registration endpoint inherited from an account management platform also used in other implementations.
DigiCert Data Breach
The archived-data system operated its own account manager instances, separate from customer-facing products. Employees authenticated using multifactor authentication, but the exposed registration flow created accounts without application assignments.
These accounts were not subject to MFA and received default read-only permissions that nevertheless allowed access to archived customer records.
DigiCert’s internal team noticed nonemployee accounts on June 18, 2026, but initially concluded that accounts without assigned applications could not access data.
A web application firewall blocked new registrations through the externally accessible path. A managed security research program subsequently reported the registration issue on June 21, prompting further verification and engineering investigation.
Investigators later established that unauthorized data access occurred between June 27 and July 2, 2026. An authorization patch deployed on July 2 rejected accounts lacking application assignments, returning HTTP 401 responses. However, DigiCert initially treated the incident as an account-creation problem rather than a confirmed data-access event.
The failure illustrates how cloud misconfigurations can combine with insufficient application authorization: restricting network access does not replace permission checks on individual endpoints.
DigiCert identified inadequate security review during migration, insufficient account-activity monitoring, and an authorization model that failed to anticipate self-registration as contributing factors.
DigiCert confirmed the reportable breach on October 19. Accessed information primarily comprised names, business email addresses, telephone numbers, and business addresses.
A small minority of customer accounts contained additional documents, including passports, driver’s licenses, or utility bills. The report describes a small proportion of archived data but provides no affected-customer count.
Unlike DigiCert’s earlier domain-validation certificate revocation incident, this event required no certificate revocations. Logs showed no associated certificate issuance, validation actions, or revocation activity; the unauthorized account could neither modify records nor approve validations.
Remediation included disabling self-registration, moving remaining endpoints behind private-IP load balancers, resetting business-system passwords, and adding file-access alerts. DigiCert scheduled final exposure auditing and account-monitoring reviews for November 6, and both activities are ongoing.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
