# DigiCert Security Lapse Exposes Sensitive Customer Identity Documents A botched server migration left internal systems vulnerable to unauthorized access for sixteen months. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-11-06 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/301843dc-0c55-4bb3-83eb-f43b65625315 ## System Migration Security Failure DigiCert confirmed a severe security lapse originating from a server migration in February 2025. An internal business system was moved to a new availability zone, inadvertently exposing it to the public internet. This configuration error remained undetected for over sixteen months, bypassing critical VPN protections that were previously in place. ## Unauthorized Access to Records The exposed system contained sensitive customer data, including names, business emails, and phone numbers. More alarmingly, some records included scanned identity documents such as passports, driver's licenses, and utility bills. DigiCert is currently reviewing these archives to identify exactly which individuals had their personal identification documents compromised during the exposure. ## Flawed Account Management Platform The internal system utilized a platform that featured a self-registration function never intended for public access. This flaw allowed unauthorized users to create accounts without multifactor authentication. Combined with a separate permissions error, these accounts gained the ability to browse archived customer records, leading to the unauthorized data access event. ## Delayed Detection and Response DigiCert discovered unauthorized accounts on June 18, 2026, but initially dismissed them as harmless. A security researcher alerted the company to the registration issue three days later, yet the system remained active until July 2. The company did not confirm that actual data access occurred until October 19, following a lengthy investigation. ## Scope of the Breach Unauthorized access occurred specifically between June 27 and July 2, 2026. While DigiCert describes the affected records as a small proportion of its total archive, the company has not disclosed the exact number of impacted customers. They are currently notifying affected parties as they complete their internal review of the documents. ## Core Infrastructure Remains Secure Despite the internal system breach, DigiCert stated that its core certificate authority operations, CertCentral, and DigiCert ONE platforms were unaffected. Customer credentials and issued digital certificates remain secure. The company found no evidence that the unauthorized accounts were used to issue, revoke, or validate any certificates during the entire incident. ## Remediation and Security Upgrades Following the discovery, DigiCert disabled the self-registration feature and tightened network access controls. The company also implemented new monitoring protocols designed to detect suspicious activity that previously went unnoticed. These measures aim to prevent similar configuration errors from exposing internal systems to the public internet in the future, addressing previous oversight. ## Implications for Data Privacy The incident highlights the risks associated with improper server migrations and inadequate security reviews. While certificate integrity remains intact, the exposure of government-issued identification documents presents a significant privacy risk for affected users. This event serves as a reminder of the critical importance of rigorous access control testing for internal systems. ## Sources covering this story - https://www.theregister.com/security/2026/11/06/digicert-admits-16-month-security-lapse-exposed-customer-information/5308097 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._