DigiCert admits 16-month security lapse exposed customer information
DigiCert exposed customer data for 16 months due to a botched server migration.
Run DigiCert?
Get an email when a reviewed story names DigiCert, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
DigiCert has admitted to a significant security lapse where an internal system was exposed to the internet for over 16 months following a botched server migration in February 2025. This exposure allowed unauthorized users to create accounts without multi-factor authentication and access archived customer data, including identity documents like passports and driver's licenses. The company only discovered the breach in June 2026 after a security researcher raised concerns, and confirmed unauthorized access occurred between late June and early July 2026.
The lesson from this incident
Full lessonFollowing a botched server migration in February 2025, DigiCert left an internal system accidentally exposed to the public internet for over 16 months — a misconfiguration that went entirely undetected by the company itself. The exposed system allowed unauthorized users to register accounts without multi-factor authentication, granting access to archived customer identity documents including passports and driver's licenses. The breach was only discovered in June 2026 when an external security researcher flagged it, meaning DigiCert's own monitoring and asset management controls completely failed to catch the exposure. This incident illustrates how a single migration error, left unreviewed, can silently undermine an organization's entire security posture and expose highly sensitive personal data for an extended period.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.