DigiCert Server Migration Misconfiguration Exposes Customer PII and Identity Documents
What Happened — DigiCert disclosed that a February 2025 server migration unintentionally exposed an internal business system to the public internet. The system, previously reachable only via VPN, included a self‑registration feature that allowed external users to create accounts. An authorization flaw granted those accounts read‑only access to archived customer records. Unauthorized access was first observed in June 2026, but the breach was only confirmed on 19 October 2026 after a managed‑security‑research report. Exposed data comprised names, business email addresses, phone numbers, business addresses, and, for some customers, scanned identification documents such as driver’s licenses, passports, and utility bills. DigiCert has notified affected customers and applied security fixes to restrict access.
Why It Matters for Trust & Control Assurance — The incident highlights the critical need for rigorous access‑control and configuration‑management controls—one VCF control objective that satisfies multiple frameworks (e.g., NIST CSF, ISO 27001).
Who Is Affected — Certificate authorities, PKI service providers, and their enterprise customers that submitted identity documents for certificate issuance.
Recommended Actions
- Conduct a comprehensive review of network segmentation and ensure all internal systems remain behind authenticated VPNs or zero‑trust controls.
- Audit and remediate authorization logic for any self‑service or registration features; enforce least‑privilege access.
- Implement continuous configuration‑change monitoring and retain immutable evidence for audit readiness.
- Update incident‑response playbooks to treat unexpected account creation as a potential data‑access event.
Source: BleepingComputer
Technical Notes
- Attack vector: misconfiguration during server migration exposing a VPN‑restricted system to the internet.
- No CVE; the flaw stemmed from an authorization oversight in a custom self‑registration module.
- Data accessed in read‑only mode between 27 June and 2 July 2026.
Source: Mozilla Bugzilla incident report