DigiCert says a server migration mistake exposed customer information and identity documents

DigiCert, one of the world’s largest certificate authorities, has disclosed that a server migration mistake left an internal business system open to the internet for about 16 months. Unauthorized accounts reached archived customer information there, and some records held identity documents such as passports and driver’s licenses. The company says its certificate issuance and validation systems were not touched.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

The disclosure surfaced in Mozilla’s CA compliance tracker and was widely reported on Nov. 5 and 6. DigiCert has not said how many people are affected, describing the exposed records as a small proportion of its archive.

The company’s own account is in Mozilla bug 2084460, filed through DigiCert’s compliance account on Oct. 20 with a full report following. It says a migration on Feb. 4, 2025 moved the business system from a VPN-restricted network segment to an externally reachable availability zone. A self-registration feature from the underlying account management platform came along with it, even though it was never meant to be available there. Accounts created through it skipped multifactor authentication and defaulted to read-only, yet could still reach archived data.

The timeline from February 2025 to October 2026

DigiCert says a managed security program report flagged possible external account creation on June 21, 2026, and The Register reports that the company had noticed unassigned accounts three days earlier and judged them harmless. The access window that DigiCert later established ran from June 27 to July 2, 2026, the day an authorization fix shipped.

The company first suspected that archived data had really been accessed on Oct. 12 and confirmed it on Oct. 19, deciding the incident was reportable. Self-registration was switched off on Oct. 24 and external endpoints were moved behind internal load balancers. The Register’s account by Carly Page counts the whole lapse at 16 months.

The design flaw behind the exposure was ordinary. The archive ran on the same account management platform that DigiCert uses for customer-facing products, and that platform ships with self-registration. On the internal system the feature was never supposed to be reachable, but once the server was reachable from outside, anyone could create an account without a second factor. A separate permissions flaw then let accounts with no assigned application browse stored records.

Customer information and identity documents at issue

Most of what was exposed is business contact data: names, business email addresses, phone numbers and business addresses. A small minority of customer accounts also held documents collected during identity checks, including driver’s licenses, passports and utility bills. BleepingComputer’s report led with the identity documents, which are the part of the archive most useful for impersonation.

DigiCert has begun notifying affected customers. In an email seen by The Register, the company said it is completing a review of identification documents to determine which individuals are involved and will contact them when that finishes. It told Mozilla that summary statistics are available to root program representatives on request.

The company reports no sign that the unauthorized account was used to issue, revoke or validate a certificate. CertCentral and DigiCert ONE, its customer platforms, were not affected, and issued certificates and customer credentials remain secure, according to its statement.

For a company whose business is vouching for identities, the lapse is awkward. Certificate authorities collect identity documents so they can validate who is asking for a certificate, and customers hand them over on the expectation that they sit behind strict controls. The postmortem says the archive’s controls did not travel with the system when it moved.

Fixes and the questions Mozilla’s reviewers asked

The postmortem is candid about the cause. The migration was handled as an infrastructure change rather than a security change, so it received no security review, and monitoring was never updated for the new location. As The Register summarized it, monitoring failed to pick up suspicious activity.

Remediation included blocking the registration endpoint at the web application firewall, restricting the system to VPN traffic again, returning HTTP 401 errors to unassigned accounts, resetting every business-system password and completing a penetration test. DigiCert now requires security sign-off for network access changes and added alerts on file access and request volume. Two items, confirming the external attack surface and reviewing account-creation alerting, were due Nov. 6.

Customers who deal with DigiCert have little to do until a notice arrives, since the company says credentials and issued certificates remain secure. Anyone who submitted a passport or license for validation can watch for the individual notification DigiCert promises once its document review finishes, and treat unexpected requests that cite DigiCert with extra suspicion in the meantime.

Reviewers on the Mozilla thread have already pressed for more. One asked DigiCert to confirm whether subscriber verification information was exposed and to supply numbers, and another asked what prompted the Oct. 12 suspicion and how the system relates to certificate validation. As of the latest reading, the report has not answered either, and the count of affected people is still unpublished. Coverage from teiss and SC Media repeats the same open points.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.