Published • loading... • Updated
DigiCert Data Breach Exposes Customer Information, Identity Documents
The certificate authority says a read-only flaw exposed archived customer records and identity documents after a migration, while certificate services and login credentials remained secure.
- DigiCert warned customers that a February 4, 2025, server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to archived customer data and personal identification documents for more than 16 months.
- The exposure originated when infrastructure migration moved the system from a VPN-restricted network segment to an externally accessible availability zone, enabling outsiders to create accounts without multifactor authentication and browse archived records via a permissions flaw.
- Exposed records contained names, business email addresses, phone numbers, and business addresses, with some potentially including passports or driver's licenses; DigiCert described the affected records as a "small proportion" of its archive.
- Cloud architect Fabian Bader criticized the notification on X, writing, "Thanks @digicert that your data leak was 'limited' to only my full PII data and potentially any verification documents I submitted for my certificate."
- DigiCert stated that certificate authority services, CertCentral, and DigiCert ONE platforms were not compromised, and customer credentials and issued certificates remain secure as the company implements additional access controls and disabled self-registration.
Insights by Ground AI
13 Articles
13 Articles
BleepingComputerReposted by 
databreaches.net
databreaches.netDigiCert data breach exposes customer information, identity documents
DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. [...]
·Melville, United States
Read Full Article
A server transfer made an internal DigiCert system accessible from the Internet for more than 16 months. The company confirmed that an unauthorized account consulted some of its files and that some could include passports, driver's licenses and other identity documents.
Coverage Details
Total News Sources13
Leaning Left0Leaning Right0Center3Last UpdatedBias Distribution100% Center
Bias Distribution
- 100% of the sources are Center
100% Center
C 100%
Factuality
To view factuality data please Upgrade to Premium
