By 
DigiCert has reported a data breach following an error during a server migration. This incident has exposed a portion of archived customer data, which includes sensitive personal information and identity documents. The breach occurred when an internal business system was inadvertently left accessible on the internet, raising significant alarms about cybersecurity practices.
DigiCert, a well-known certificate authority, confirmed that the exposed data comprises names, business email addresses, phone numbers, and physical addresses of some customers. More alarming still, for certain individuals, the breach includes highly sensitive identification documents such as driver's licenses, passports, and utility bills. This incident not only highlights vulnerabilities in digital security practices but also raises critical questions about the safety of customer information in the hands of service providers.
Following the discovery of the breach, DigiCert has begun notifying affected customers as part of their response protocol. Cloud architect Fabian Bader took to social media to express his dismay, stating, "Thanks @digicert that your data leak was 'limited' to only my full PII data and potentially any verification documents I submitted for my certificate." This underscores the real impact that such leaks can have on individual privacy.
The breach's origins can be traced back to a server migration that took place in February 2025, which mistakenly made an internal business system accessible outside its usual secure channels. Previously, this system was only reachable via a VPN, ensuring a layer of security. However, an unintended error during the migration opened the floodgates for unauthorized access, allowing external actors to register and create accounts on the system.
An incident report from Mozilla's Bugzilla further elucidates the sequence of events leading to the breach. Although reports about unauthorized accounts were noted in June 2026, it was initially believed that these accounts could not access customer information due to security measures in place. It wasn't until October 19 that a thorough investigation revealed that indeed, an unauthorized account had accessed customer information between the end of June and early July.
DigiCert acknowledged that the initial handling of the incident was somewhat misguided, viewing it primarily as an issue of account creation rather than recognizing the gravity of the data access that was occurring. Following the report from its managed security research program, they swiftly took steps to enhance security by implementing fixes to restrict access and rectify the authorization flaw.
The company assures its clients that the unauthorized access was limited in capacity; the account in question had read-only access, meaning it could not alter any records, approve certificate validations, or issue new certificates. Nevertheless, the potential for personal information to have been accessed poses a significant risk to privacy and personal security.
To mitigate further risks, DigiCert has now restricted access to the affected system, disabled the self-registration feature, and instituted stronger access controls. Importantly, they have clarified that their primary services, including the CertCentral and DigiCert ONE platforms, remain secure, and despite this breach, customer login credentials and issued certificates are unharmed.
The incident has raised eyebrows in the cybersecurity community, prompting discussions on the necessity of rigorous security measures during internal changes such as server migrations. Questions remain regarding the number of customers impacted, as well as what long-term measures will be taken to prevent similar occurrences in the future.
As organisations increasingly rely on digital systems to manage sensitive data, the importance of stringent cybersecurity protocols cannot be overstated. Customers ought to remain vigilant about safeguarding their information and consider changes to their personal security practices following such revelations.
Source: bleepingcomputer.com
