Overview
- DigiCert says a February 2025 infrastructure migration left an internal registration endpoint exposed and that attackers used that weakness to read archived customer records between June 27 and July 2, 2026, a fact the company confirmed on October 19.
- The intruders exploited a self-registration feature and an authorization design flaw to create external accounts that bypassed protections and gained read-only access to archived data.
- Exposed information included names, business contact details and, in some cases, identity documents such as driver’s licenses, passports, or utility bills that customers had provided.
- DigiCert has disabled self-registration, restricted access, added monitoring and controls, begun notifying affected customers, and says its certificate authority services, customer credentials, and issued certificates were not modified or compromised.
- The company has not disclosed how many customers were affected, which increases the risk of fraud for those impacted and underscores how configuration errors during migrations can expose sensitive records.