# DigiCert Security Lapse Exposes Sensitive Customer Identity Documents A botched server migration left internal systems vulnerable to unauthorized access for sixteen months. - **Source:** [The Register](https://www.theregister.com) - **Published:** 2026-11-06 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/eaa42a70-2a16-4f4f-b8b0-b5a84f08a5a7 ## System Migration Security Failure DigiCert confirmed that a server migration in February 2025 inadvertently exposed an internal system to the public internet. This misconfiguration persisted for sixteen months without detection. The system, which was intended to remain behind a VPN, became accessible to unauthorized users due to a lack of proper security review during the transition. ## Unauthorized Access Mechanism The exposed system utilized a self-registration feature that lacked mandatory multifactor authentication. This flaw allowed outsiders to create accounts and exploit separate permission errors to browse archived customer records. Although the company discovered these unauthorized accounts on June 18, 2026, they initially dismissed the activity as harmless, delaying a necessary response. ## Sensitive Data Exposure Scope Compromised information includes names, business email addresses, phone numbers, and physical business addresses. More critically, some records contained scanned identity documents such as passports, driver's licenses, and utility bills. DigiCert is currently reviewing these archives to identify specific individuals impacted, though the total number of affected customers remains officially undisclosed. ## Delayed Incident Response Timeline A security researcher alerted DigiCert to the account creation vulnerability on June 21, 2026, yet the company did not disable the feature until July 2. Investigations into whether data was actually accessed did not commence until October 12, eventually confirming that unauthorized parties browsed records between June 27 and July 2. ## Core Operations Remain Secure Despite the significant breach of archived customer data, DigiCert stated that its core certificate authority operations remain unaffected. Services including CertCentral and DigiCert ONE were not compromised. The company found no evidence that the unauthorized access was used to issue, revoke, or validate digital certificates, protecting the integrity of its primary infrastructure. ## Remediation and Security Upgrades Following the discovery, DigiCert disabled the self-registration feature and tightened network access controls to prevent future unauthorized entry. The company also implemented enhanced monitoring protocols designed to detect suspicious activity earlier. These measures aim to address the systemic failures that allowed the internal archive to remain exposed for over a year. ## Postmortem Analysis of Failures The internal postmortem report highlights critical failures in DigiCert's operational security processes. The server migration lacked a formal security review, and existing monitoring tools failed to flag suspicious account activity. Furthermore, the reliance on an internal system that shared account management platforms with customer-facing products created an unnecessary and dangerous security risk. ## Impact on Customer Trust While the company claims only a small proportion of its archive was accessed, the exposure of government-issued identity documents poses a long-term risk for affected individuals. DigiCert has begun notifying those impacted but has yet to provide a comprehensive count. This incident underscores the severe consequences of neglecting internal network security configurations. ## Sources covering this story - https://www.theregister.com/security/2026/11/06/digicert-admits-16-month-security-lapse-exposed-customer-information/5308097 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._