[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6JjwuGTJ5NtYJ2JH9sPLFkXDvOF35m9uKXb1qokCH3Y":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":124},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"63816a7b-49a1-4e7b-8411-e1950aa448d3","DigiCert admits 16-month security lapse exposed customer information","digicert-admits-16-month-security-lapse-exposed-customer-information-f918c8","Botched server move left the door open, and DigiCert took months to notice someone had wandered in","DigiCert has admitted to a significant security lapse where an internal system was exposed to the internet for over 16 months following a botched server migration in February 2025. This exposure allowed unauthorized users to create accounts without multi-factor authentication and access archived customer data, including identity documents like passports and driver's licenses. The company only discovered the breach in June 2026 after a security researcher raised concerns, and confirmed unauthorized access occurred between late June and early July 2026.","DigiCert exposed customer data for 16 months due to a botched server migration.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F06\u002Fdigicert-admits-16-month-security-lapse-exposed-customer-information\u002F5308097","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5305665&width=800","2026-11-06T13:15:00+00:00","2026-11-06T14:00:16.540653+00:00",8,[17],{"name":18,"type":19},"DigiCert","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":20,"icon":22,"name":23,"slug":24},null,"Breaches","breaches",[26,28,33,38],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":46,"vendors":123},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":77,"name":78,"problem":79,"products":80},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[110,118],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":119,"product_name":120,"url":121,"description":122},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[],{"slug":125,"title":126,"body":127,"framework_refs":128,"framework_notes":136},"digicerts-16-month-internet-exposure-leaks-customer-identity-documents","DigiCert's 16-Month Internet Exposure Leaks Customer Identity Documents","Following a botched server migration in February 2025, DigiCert left an internal system accidentally exposed to the public internet for over 16 months — a misconfiguration that went entirely undetected by the company itself. The exposed system allowed unauthorized users to register accounts without multi-factor authentication, granting access to archived customer identity documents including passports and driver's licenses. The breach was only discovered in June 2026 when an external security researcher flagged it, meaning DigiCert's own monitoring and asset management controls completely failed to catch the exposure. This incident illustrates how a single migration error, left unreviewed, can silently undermine an organization's entire security posture and expose highly sensitive personal data for an extended period.",[129,130,131,132,133,134,135],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIS2 Article 21(2)(b)",{"GDPR Article 32":137,"NIS2 Article 21(2)(b)":138,"CIS Control 6: Access Control Management":139,"CIS Control 13: Network Monitoring and Defense":140,"CIS Control 1: Inventory and Control of Enterprise Assets":141,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":142,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":143},"Article 32 requires appropriate technical measures to ensure the security of personal data; the absence of MFA and exposure controls on a system holding identity documents such as passports directly violates this obligation.","NIS2 mandates incident handling and proactive security measures for entities handling sensitive data; DigiCert's 16-month failure to detect the exposure and its reliance on an external researcher demonstrates inadequate internal controls required under this article.","Enforcing MFA as a baseline requirement for all externally accessible systems would have prevented unauthorised users from successfully creating accounts and accessing archived customer data.","Continuous monitoring of network traffic and anomalous account-creation events on the exposed system would have detected unauthorized access far earlier than the 16-month window that elapsed.","Maintaining an accurate, continuously reconciled inventory of all internet-facing assets would have flagged the misconfigured server as an unauthorised exposure immediately after the February 2025 migration.","Regular review of system configurations and exposure status — required under this control — would have identified the unintended internet-facing configuration as a vulnerability to be remediated during the 16-month window.","This function requires organisations to enforce strong authentication controls on all systems; applying it post-migration would have mandated MFA on the exposed portal and blocked unauthenticated account creation."]