DigiCert Confirms Data Breach After Security Misconfiguration Exposes Customer Personal Information - GBHackers News

The exposure originated on February 4, 2025, when an infrastructure migration moved the system from a VPN-restricted network segment to an externally accessible availability zone. The change inadvertently exposed a self-service registration endpoint inherited from an account management platform.

Unauthorized Access

The archived-data system operated separate account manager instances, with employees using multifactor authentication. However, the exposed registration flow created accounts without application assignments, bypassing MFA requirements with default read-only permissions that still allowed access to archived customer records.

DigiCert's internal team noticed nonemployee accounts on June 18, 2026, but initially concluded that accounts without assigned applications couldn't access data. A managed security research program reported the registration issue on June 21, prompting further investigation.

Impact and Response

Investigators established that unauthorized data access occurred between June 27 and July 2, 2026. Accessed information primarily comprised names, business email addresses, telephone numbers, and business addresses. A small minority of customer accounts contained additional documents including passports, driver's licenses, or utility bills.

The failure illustrates how cloud misconfigurations can combine with insufficient application authorization: restricting network access does not replace permission checks on individual endpoints.

DigiCert identified inadequate security review during migration, insufficient account-activity monitoring, and an authorization model that failed to anticipate self-registration as contributing factors. Unlike DigiCert's earlier domain-validation certificate revocation incident, this event required no certificate revocations.