DigiCert discloses 16-month exposure of archived customer identity records
BREACHDigiCertredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
DigiCert says a February 2025 migration of an internal business system moved it from a VPN-protected network to a zone exposed to the public internet, where it remained for over 16 months. The archive shared an account platform with customer products, so an unauthorised user could self-register accounts without MFA and, through a separate permissions flaw, browse archived records. Exposed data included names, business contact details and, in some cases, passports, driver's licences and utility bills; the number of affected people has not been disclosed.
For IT people · Written by AI from 1 source · Wrong?
What to do
- If you are a DigiCert customer, watch for a notification from the company about whether your information was affected.
- Be cautious of unexpected contact referring to DigiCert, as it has not yet said how many people were affected.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Register (Security)
Who and what is in it
Companies