# DigiCert Security Lapse Exposes Sensitive Customer Identity Documents A botched server migration left internal systems exposed to the internet for sixteen months. - **Source:** [www.theregister.com - Articles](https://www.theregister.com) - **Published:** 2026-11-06 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/eb90c2b3-1681-4a57-a29a-8872612a8b1e ## Unauthorized System Exposure DigiCert confirmed a major security failure resulting from a flawed server migration initiated in February 2025. An internal system was moved to a public-facing network zone without adequate protection, remaining exposed to the internet for over sixteen months. This oversight allowed unauthorized users to bypass standard security protocols and access sensitive data. ## Sensitive Data Compromised The breach exposed personal information including names, business email addresses, phone numbers, and physical addresses. More critically, some records contained government-issued identification documents such as passports and driver's licenses. DigiCert is currently conducting a thorough review to identify exactly which individuals had their private identity documents accessed by the unauthorized parties. ## Vulnerability Mechanism Explained The exposed system utilized a self-registration feature that was never intended for public access. Because the platform lacked mandatory multifactor authentication, outsiders could create accounts effortlessly. A separate permissions flaw then permitted these unauthorized accounts to browse through archived customer records, effectively bypassing the intended internal security architecture of the company. ## Delayed Detection Timeline DigiCert first identified unauthorized accounts on June 18, 2026, but initially dismissed them as harmless. A security researcher alerted the firm to the registration issue three days later, yet the system remained active until July 2. The company did not confirm that actual data access had occurred until October 19, 2026. ## Scope of the Breach While DigiCert maintains that the affected records represent only a small proportion of its total archive, the exact number of impacted customers remains undisclosed. The unauthorized access occurred specifically between June 27 and July 2, 2026. The company is currently notifying affected parties as their internal investigation into the incident continues. ## Operational Impact Assessment Crucially, DigiCert stated that its core certificate authority operations, including CertCentral and DigiCert ONE, were not affected by this incident. Customer credentials and issued digital certificates remain secure, and there is no evidence that the unauthorized account was used to issue, revoke, or validate any certificates during the exposure period. ## Remediation and Security Changes Following the discovery, DigiCert disabled the self-registration feature and implemented stricter network access controls. The company also deployed enhanced monitoring tools designed to detect suspicious activity that previously went unnoticed. These technical adjustments aim to prevent similar configuration errors from occurring during future infrastructure migrations or internal system updates moving forward. ## Broader Security Implications This incident highlights the severe risks associated with inadequate security reviews during server migrations. By failing to verify network configurations, DigiCert allowed a critical vulnerability to persist for over a year. The event serves as a stark reminder of the importance of rigorous access control testing for all internal business systems. ## Sources covering this story - https://www.theregister.com/security/2026/11/06/digicert-admits-16-month-security-lapse-exposed-customer-information/5308097 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._