Data Breach Notification,
Data Security,
Governance & Risk Management
Botched Network Migration Allowed Unauthorized Access to Internal Customer Archive
A significant security lapse occurred at DigiCert, a prominent certificate authority, after a flawed internal system migration led to unauthorized access to sensitive customer information. This breach compromised personal and business data for over a year, raising critical concerns about data security protocols within the organization.
In February 2025, DigiCert executed a migration of its internal system from a secure VPN environment to a zone accessible publicly over the Internet. This miscalculation inadvertently exposed the system to unauthorized access vulnerabilities. Although the firm discovered the breach in June 2026, it was over a month before they deployed an effective fix, leaving sensitive customer data vulnerable during this period.
The breach uncovered a range of confidential information, including names, business email addresses, phone numbers, and physical addresses. Alarmingly, some files contained identity verification documents such as driver’s licenses, passports, and utility bills—all vital information that could facilitate identity theft.
DigiCert was quick to clarify that no login credentials or their issued certificates had been compromised in the incident. Importantly, their services—specifically, CertCentral and DigiCert ONE—remained unaffected by this security breach.
In a statement to ISMG, DigiCert confirmed that they had reached out to all affected customers and partners while reviewing the implications of the exposed information. The company conducted an internal root cause analysis and admitted that the modifications made during the network migration occurred without a comprehensive security review of the new attack surface.
As part of the migration, an account registration feature was inadvertently exposed, allowing external users to create accounts granting access to the internal archive. This feature was intended solely for information storage, not for account creation. Consequently, accounts that were created via this externally accessible pathway did not incorporate multifactor authentication, which further heightened the risk of unauthorized access.
While it was established that self-registered accounts held read-only permissions, this level of access was adequate for malicious actors to exfiltrate sensitive customer data from the archive. Initial assessments by DigiCert indicated that the unauthorized account could not retrieve any information due to its lack of association with any application. However, this error was corrected days later when a managed security program highlighted the vulnerability and the ensuing attack logic.
In response to this incident, DigiCert has since implemented substantial security measures. These measures include placing the affected archive behind a web application firewall, restricting account registrations from external access, and instituting alerts for blocked access attempts to fill the previously existing monitoring gaps.
The delay in identifying and rectifying the breach has sparked a wave of concern among cybersecurity experts and professionals. The repercussions of such breaches can have long-lasting effects on customer trust and organizational reputation.
On social media platform X, security architect Fabian Bader expressed his frustration, pointing out that he was relieved that the data leak was limited to only his complete personally identifiable information (PII) and potentially any verification documents he had provided for his DigiCert certificate. The implications of such breaches have resonated deeply with many, as noted by security engineer Donovan Farrell. He cautioned that documents like passport scans and utility bills are often used by customer service representatives to verify identities when resetting accounts, adding to the concern regarding the potential misuse of the exposed data.
This incident serves as a stark reminder of the importance of rigorous security protocols during any significant system changes. Organizations like DigiCert must take the necessary precautions to ensure that all aspects of network migrations are undertaken with a comprehensive understanding of the security risks involved to protect their customers’ sensitive information.