DigiCert's 16-Month Internet Exposure Leaks Customer Identity Documents
Following a botched server migration in February 2025, DigiCert left an internal system accidentally exposed to the public internet for over 16 months — a misconfiguration that went entirely undetected by the company itself. The exposed system allowed unauthorized users to register accounts without multi-factor authentication, granting access to archived customer identity documents including passports and driver's licenses. The breach was only discovered in June 2026 when an external security researcher flagged it, meaning DigiCert's own monitoring and asset management controls completely failed to catch the exposure. This incident illustrates how a single migration error, left unreviewed, can silently undermine an organization's entire security posture and expose highly sensitive personal data for an extended period.
Tactical Insight
Immediate actions
- Conduct a full audit of all internet-facing assets and compare against an authorised asset inventory to identify unintended exposures.
- Enforce mandatory multi-factor authentication on every externally accessible system and account registration endpoint without exception.
Long-term improvements
- Implement a formal post-migration verification checklist that includes network exposure validation and access control review before any migrated system is considered production-ready.
- Establish a continuous attack surface management (ASM) programme to automatically detect and alert on newly exposed services or unexpected internet-facing assets.
- Apply the principle of least privilege to all internal systems, ensuring archived customer data is only accessible to explicitly authorised roles.
Detection measures
- Deploy centralised logging and anomalous account creation alerts so that unexpected self-registration activity triggers an immediate security investigation.
- Schedule regular third-party penetration tests and bug bounty engagement so that exposures like this are found internally before external researchers discover them.