DigiCert discloses 16-month exposure of archived customer identity records
- Severity
- High
- Sources
- 1
What happened
DigiCert's postmortem attributes the exposure to a February 2025 move of an internal archive system from a VPN-protected network to a different availability zone, which made it internet-accessible without a security review. Self-registration (no MFA) on the shared account management platform and a permissions flaw allowed unauthorised accounts to read archived customer records; these were first seen 18 June 2026, the researcher alert followed three days later, and access was shut down on 2 July, with unauthorised access confirmed for 27 June to 2 July. No CVE is cited. DigiCert says it has disabled self-registration, tightened network access and added monitoring, and found no evidence of certificate issuance, revocation or validation abuse.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- If you are a DigiCert customer, watch for a notification from the company about whether your information was affected.
- Be cautious of unexpected contact referring to DigiCert, as it has not yet said how many people were affected.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies