[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCAa2Y2qBRfuExk4Wk-G37moMzlvgEoKr-iEmWpf_PrM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"f61c2125-2ff0-4586-9377-455a792cae50","digicerts-16-month-internet-exposure-leaks-customer-identity-documents","63816a7b-49a1-4e7b-8411-e1950aa448d3","DigiCert's 16-Month Internet Exposure Leaks Customer Identity Documents","Following a botched server migration in February 2025, DigiCert left an internal system accidentally exposed to the public internet for over 16 months — a misconfiguration that went entirely undetected by the company itself. The exposed system allowed unauthorized users to register accounts without multi-factor authentication, granting access to archived customer identity documents including passports and driver's licenses. The breach was only discovered in June 2026 when an external security researcher flagged it, meaning DigiCert's own monitoring and asset management controls completely failed to catch the exposure. This incident illustrates how a single migration error, left unreviewed, can silently undermine an organization's entire security posture and expose highly sensitive personal data for an extended period.","**Immediate actions:**\n- Conduct a full audit of all internet-facing assets and compare against an authorised asset inventory to identify unintended exposures.\n- Enforce mandatory multi-factor authentication on every externally accessible system and account registration endpoint without exception.\n\n**Long-term improvements:**\n- Implement a formal post-migration verification checklist that includes network exposure validation and access control review before any migrated system is considered production-ready.\n- Establish a continuous attack surface management (ASM) programme to automatically detect and alert on newly exposed services or unexpected internet-facing assets.\n- Apply the principle of least privilege to all internal systems, ensuring archived customer data is only accessible to explicitly authorised roles.\n\n**Detection measures:**\n- Deploy centralised logging and anomalous account creation alerts so that unexpected self-registration activity triggers an immediate security investigation.\n- Schedule regular third-party penetration tests and bug bounty engagement so that exposures like this are found internally before external researchers discover them.",[12,13,14,15,16,17,18],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIS2 Article 21(2)(b)",{"GDPR Article 32":20,"NIS2 Article 21(2)(b)":21,"CIS Control 6: Access Control Management":22,"CIS Control 13: Network Monitoring and Defense":23,"CIS Control 1: Inventory and Control of Enterprise Assets":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"Article 32 requires appropriate technical measures to ensure the security of personal data; the absence of MFA and exposure controls on a system holding identity documents such as passports directly violates this obligation.","NIS2 mandates incident handling and proactive security measures for entities handling sensitive data; DigiCert's 16-month failure to detect the exposure and its reliance on an external researcher demonstrates inadequate internal controls required under this article.","Enforcing MFA as a baseline requirement for all externally accessible systems would have prevented unauthorised users from successfully creating accounts and accessing archived customer data.","Continuous monitoring of network traffic and anomalous account-creation events on the exposed system would have detected unauthorized access far earlier than the 16-month window that elapsed.","Maintaining an accurate, continuously reconciled inventory of all internet-facing assets would have flagged the misconfigured server as an unauthorised exposure immediately after the February 2025 migration.","Regular review of system configurations and exposure status — required under this control — would have identified the unintended internet-facing configuration as a vulnerability to be remediated during the 16-month window.","This function requires organisations to enforce strong authentication controls on all systems; applying it post-migration would have mandated MFA on the exposed portal and blocked unauthenticated account creation.","published","2026-11-06T14:21:06.435779+00:00","2026-11-06T14:21:06.423+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F06\u002Fdigicert-admits-16-month-security-lapse-exposed-customer-information\u002F5308097","digicert-admits-16-month-security-lapse-exposed-customer-information-f918c8","DigiCert admits 16-month security lapse exposed customer information",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":42,"name":43,"slug":44,"description":45,"color":46},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":48,"name":49,"slug":50,"description":51,"color":52},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[55,59,63],{"slug":56,"name":57,"problem":58},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":60,"name":61,"problem":62},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":64,"name":65,"problem":66},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date."]