DigiCert has admitted that a botched server migration left an internal system exposed to the internet for more than a year, allowing an unauthorized user to access customer data, including passports, driver’s licenses, and other identity documents. The certificate authority has begun notifying affected customers but has yet to disclose how many people had their information exposed. In an email seen by The Register, DigiCert confirmed the compromised information included names, business email addresses, phone numbers, and business addresses. Some records may also have contained passports, driver’s licenses, utility bills, or other identification documents. “We are completing a review of identification documents to determine the specific individuals involved,” DigiCert told those affected, adding that it would notify those people once the review was complete. DigiCert’s incident report traces the blunder back to February 2025, when an internal business system was moved from a VPN-protected network to a different availability zone. That change also opened the system up to the public internet, where it sat for more than 16 months without DigiCert realizing. The archive used the same account management platform as DigiCert’s customer-facing products, including a self-registration feature that was never supposed to be available on the internal system. This allowed outsiders to create accounts without multifactor authentication and, thanks to a separate permissions flaw, use them to browse archived customer records. DigiCert found the unauthorized accounts on June 18, 2026, but initially dismissed them as harmless because they weren’t assigned to an application. A security researcher raised the alarm about the account creation issue three days later, but it took until July 2 for DigiCert to shut it down. Unfortunately, someone had already been poking around. It wasn’t until October 12 that DigiCert began investigating whether customer information had actually been accessed. On October 19, it confirmed that an unauthorized account had accessed a subset of archived records between June 27 and July 2. DigiCert described the affected records as a “small proportion” of its archive but hasn’t disclosed how many customers or individuals were caught up in the breach. The company did not respond to The Register’s questions at the time of publication. DigiCert’s postmortem makes for uncomfortable reading. The server move didn’t get a proper security review, monitoring failed to pick up suspicious activity, and the access controls weren’t much use against self-registered accounts. The company has since switched off self-registration, tightened network access, and added monitoring that might have come in handy a few months earlier. Certificate authority operations, CertCentral, and DigiCert ONE were unaffected, the company said, adding that customer credentials and issued certificates remain secure. It also found no evidence that the unauthorized account had been used to issue, revoke, or validate certificates. That’s good news for anyone worried about their certificates, but less so for those who handed DigiCert a copy of their passport. ®
