Summary
- A February 2025 migration inadvertently exposed DigiCert's internal business system to the internet.
- An unauthorised account accessed archived customer information between 27 June and 2 July 2026.
- DigiCert says certificate operations and issued certificates were unaffected, but its investigation identified failures in access controls and monitoring.
Certificate authority DigiCert has disclosed unauthorised access to archived customer information after an infrastructure migration inadvertently exposed an internal business system to the internet, with its investigation identifying failures in network security reviews, authorisation, and monitoring.
The affected information included business contact details and, for a smaller number of customer accounts, personal identification documents supplied during validation procedures.
DigiCert confirmed that an unauthorised account accessed a subset of archived records between 27 June and 2 July 2026. The company first identified potentially unauthorised accounts in June but did not establish that customer information had been accessed until 19 October.
The incident did not affect DigiCert’s certificate authority operations, issued certificates, or customer login credentials, according to the company’s investigation.
Migration exposed internal account registration
The security failure originated on 4 February 2025, when DigiCert moved an internal business application from a network segment restricted by a virtual private network into a different availability zone.
The migration inadvertently made the application externally accessible. Its account management system also contained a self-registration feature intended for other applications, which became available through the exposed environment.
DigiCert employees normally accessed the system using accounts subject to multi-factor authentication. However, accounts created through the unintended registration function were not assigned to the application and were not subject to the same authentication requirement.
Those accounts should not have been able to retrieve archived information. An authorisation weakness nevertheless provided read-only access to customer records, despite the absence of an assigned application role.
The company first observed unauthorised accounts on 18 June 2026. Investigators concluded that they could not access customer information because they had not been assigned to an application.
That conclusion subsequently proved incorrect. DigiCert received a further report through its managed security research programme on 21 June, identifying the possibility of external account creation.
Engineering teams investigated the issue and developed an authorisation correction, which reached production on 2 July. The change prevented unassigned accounts from accessing archived records.
At that point, the company had not established that any information had been retrieved before the fix.
Further investigation began in October, when DigiCert reconsidered the possibility of unauthorised data access. On 19 October, it confirmed that an account had accessed archived information during the period beginning on 27 June.
Archived identity data creates continuing exposure
Most of the affected information consisted of customer representatives’ names, business email addresses, telephone numbers, and business addresses.
A smaller proportion of records contained additional personal information in the form of documents supplied by customers, potentially including passports, driving licences, utility bills, or other evidence of identity and address.
DigiCert says the incident involved only a small proportion of its archived customer information. It has not disclosed the total number of affected individuals or documents, and its review of the potentially exposed identity material is continuing.
Archived records can remain sensitive long after their original collection. Identity documents may have been supplied for legitimate certificate validation purposes, but their retention creates an ongoing responsibility to prevent unauthorised access.
Such documents can also increase the consequences of a breach because they contain information useful for impersonation or targeted social engineering. DigiCert has not reported confirmed misuse of the affected material.
Its investigation established that the unauthorised account had read-only permissions. It could not modify records, approve certificate validations, or issue certificates.
Log reviews also found no certificate issuance, validation, or revocation activity associated with the account. DigiCert says its certificate authority systems operated on separate network segments and were not compromised.
The distinction between the business system and certificate operations is important. The incident concerns the confidentiality of customer information, rather than evidence that the company’s digital certificates or underlying certificate trust systems were compromised.
Access controls failed across several layers
DigiCert’s published root cause analysis identifies three contributing failures: the migration changed network accessibility without an appropriate security review, monitoring was insufficient, and the application’s authorisation model did not account for the unintended registration function.
The company acknowledged that its initial investigation focused on account creation rather than testing whether the newly created accounts could actually access archived records.
It has since introduced additional monitoring, restricted the relevant systems to internal access, disabled the unintended registration function, and strengthened endpoint-level authorisation checks.
DigiCert also assigned clearer responsibility for the business system’s security posture and introduced a requirement for security approval when network accessibility changes.
Two further reviews, covering unexpected account activity and confirmation that internal origin systems are not externally accessible, were scheduled for completion on 6 November.
The company has begun notifying affected customers and says existing certificates remain valid, with no action required concerning their continued use.
