DigiCert confirms server migration exposed identity documents and customer data

Certificate authority DigiCert revealed that a flawed server migration left an internal business system exposed to the public internet for over 16 months, compromising customer records. An unauthorized account accessed archived data between June 27 and July 2, 2026. Compromised information includes customer names, business email addresses, phone numbers, and physical business addresses, alongside sensitive verification files such as passports, driver's licenses, and utility bills for some individuals. [2][3]

The vulnerability originated in February 2025 when the internal system was moved from a VPN-protected network to a new availability zone without a proper security review. The system inadvertently included a self-registration mechanism without multifactor authentication, while a separate authorization flaw allowed newly created external accounts read-only access to archived records. DigiCert spotted unauthorized accounts on June 18, 2026, and shut down registration on July 2 following a researcher's alert, but it did not confirm that data had been accessed until October 19. [2][3]

DigiCert stated that core certificate authority operations, customer credentials, CertCentral, and DigiCert ONE were not compromised, finding no evidence that certificates were issued, revoked, or validated by the intruder. The company has restricted network access, switched off self-registration, and added monitoring controls while it continues reviewing records to determine how many people were affected. [2][3]