How a Single Server Migration Mistake Exposed DigiCert Customer Passports and PII
In February 2025, a routine server migration at DigiCert, a leading certificate authority, inadvertently exposed an internal business system to the public internet—a system previously accessible only via VPN. The exposed system contained a self-registration feature and an authorization flaw that allowed externally created accounts to access archived customer records in read-only mode. Unauthorized access was confirmed to have occurred between June 27 and July 2, 2026, exposing customer names, business email addresses, phone numbers, business addresses, and in some cases personal identity documents including passports and driver's licenses. DigiCert did not detect the data access until October 2026, representing a significant detection gap of nearly four months. This incident highlights a growing pattern of cloud misconfiguration and access-control failures at high-trust infrastructure providers. As organizations accelerate cloud migrations, even brief operational oversights—such as omitting VPN-gating on a migrated service—can expose sensitive customer PII and identity documents, triggering regulatory and reputational consequences that far outweigh the technical simplicity of the root cause.
Kill Chain
