Ethical Hacking News
DigiCert, a prominent certificate authority, recently admitted to a 16-month security lapse that exposed customer information. The breach occurred when an internal server migration left an internal system exposed to the internet for an extended period, allowing an unauthorized user to access sensitive data. The incident highlights the importance of regular security audits, proper risk assessments, and effective monitoring systems, and serves as a cautionary tale of human error and technical failures.
DigiCert admitted to a 16-month security lapse that exposed customer information. The breach occurred when an internal server migration left a system exposed to the internet. A security researcher initially raised the alarm about account creation issues three days before DigiCert took action. DigiCert confirmed that an unauthorized account had accessed a subset of archived records between June 27 and July 2. The breach highlights the importance of regular security audits, risk assessments, and effective monitoring systems.
DigiCert, a prominent certificate authority, recently admitted to a 16-month security lapse that exposed customer information. The breach occurred when an internal server migration left an internal system exposed to the internet for an extended period, allowing an unauthorized user to access sensitive data, including passports, driver's licenses, and other identity documents.
The incident report traces the blunder back to February 2025, when the internal business system was moved from a VPN-protected network to a different availability zone. This change also opened the system up to the public internet, where it sat for more than 16 months without DigiCert realizing. The archive used the same account management platform as DigiCert's customer-facing products, including a self-registration feature that was never supposed to be available on the internal system.
This allowed outsiders to create accounts without multifactor authentication and, thanks to a separate permissions flaw, use them to browse archived customer records. DigiCert found the unauthorized accounts on June 18, 2026, but initially dismissed them as harmless because they weren't assigned to an application. A security researcher raised the alarm about the account creation issue three days later, but it took until July 2 for DigiCert to shut it down.
Unfortunately, someone had already been poking around. It wasn't until October 12 that DigiCert began investigating whether customer information had actually been accessed. On October 19, it confirmed that an unauthorized account had accessed a subset of archived records between June 27 and July 2. DigiCert described the affected records as a "small proportion" of its archive but hasn't disclosed how many customers or individuals were caught up in the breach.
The company's postmortem makes for uncomfortable reading. The server move didn't get a proper security review, monitoring failed to pick up suspicious activity, and the access controls weren't much use against self-registered accounts. DigiCert has since switched off self-registration, tightened network access, and added monitoring that might have come in handy a few months earlier.
Certificate authority operations, CertCentral, and DigiCert ONE were unaffected, the company said, adding that customer credentials and issued certificates remain secure. It also found no evidence that the unauthorized account had been used to issue, revoke, or validate certificates. This news is good for anyone worried about their certificates, but less so for those who handed DigiCert a copy of their passport.
The incident highlights the importance of regular security audits, proper risk assessments, and effective monitoring systems. It also underscores the need for companies to prioritize security awareness training for their employees and to implement robust incident response plans. DigiCert's breach serves as a cautionary tale of human error and technical failures, emphasizing the need for organizations to stay vigilant and proactive in protecting their customers' sensitive information.
Related Information:
https://www.ethicalhackingnews.com/articles/DigiCerts-16-Month-Security-Breach-A-Cautionary-Tale-of-Human-Error-and-Technical-Failures-ehn.shtml
https://www.theregister.com/security/2026/11/06/digicert-admits-16-month-security-lapse-exposed-customer-information/5308097
Published: Fri Nov 6 07:40:09 2026 by llama3.2 3B Q4_K_M
