Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In February 2025, a routine server migration at DigiCert, a leading certificate authority, inadvertently exposed an internal business system to the public internet—a system previously accessible only via VPN. The exposed system contained a self-registration feature and an authorization flaw that allowed externally created accounts to access archived customer records in read-only mode. Unauthorized access was confirmed to have occurred between June 27 and July 2, 2026, exposing customer names, business email addresses, phone numbers, business addresses, and in some cases personal identity documents including passports and driver's licenses. DigiCert did not detect the data access until October 2026, representing a significant detection gap of nearly four months.

This incident highlights a growing pattern of cloud misconfiguration and access-control failures at high-trust infrastructure providers. As organizations accelerate cloud migrations, even brief operational oversights—such as omitting VPN-gating on a migrated service—can expose sensitive customer PII and identity documents, triggering regulatory and reputational consequences that far outweigh the technical simplicity of the root cause.

Why This Matters Now

Cloud migrations are occurring at record pace across regulated industries, and misconfigurations during transitions remain the leading cause of unintended data exposure. DigiCert's breach demonstrates that even security-focused organizations can leave internal systems internet-accessible during migrations—and that authorization flaws in legacy systems can go undetected for months. With rising regulatory scrutiny under GDPR, CCPA, and emerging digital identity frameworks, exposure of PII and government-issued identity documents now carries severe legal and financial liability.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The breach revealed failures in access control governance and change management during cloud migrations, violating principles aligned with NIST 800-53 AC-6 (least privilege) and ZTMM Network segmentation requirements. The absence of VPN enforcement after migration and a prolonged four-month detection gap also suggest deficiencies in continuous monitoring controls.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the root cause was an internal business system inadvertently exposed to the public internet without any compensating network access controls. A Zero Trust segmentation model would likely have constrained the attacker's ability to reach the exposed system directly from the internet, reducing the blast radius to a much narrower and policy-gated surface.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: A Zero Trust fabric enforcing intent-based perimeter controls would likely have reduced the reachability of this internal system from the public internet, constraining an external actor's ability to even discover and interact with the self-registration endpoint in the first place.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation enforcing identity-aware access scoping would likely have constrained the privilege scope available to a newly registered, unassigned account, reducing the attacker's ability to reach archived customer data through an application-layer authorization flaw.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement across workload segments would likely have further constrained any potential lateral paths from the compromised system, reducing the risk that a foothold in one internal workload could be used to reach adjacent systems or cloud environments.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized multicloud visibility and traffic inspection would likely have surfaced anomalous inbound session patterns from unexpected external sources, giving defenders a better chance to detect and constrain the attacker's ongoing access before significant data was reached.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security and policy enforcement applied at the workload boundary would likely have constrained the volume and destination scope of outbound data flows from the exposed system, reducing the attacker's ability to exfiltrate large quantities of archived records over standard HTTPS without triggering a policy-defined egress control.

Impact (Mitigations)

Had earlier Zero Trust controls constrained attacker reachability and reduced the accessible data surface, the residual impact would likely have been limited to a narrower subset of archived customer records, reducing the regulatory and reputational exposure tied to identity document disclosure.

Impact at a Glance

Affected Business Functions

  • Certificate Authority Customer Identity Verification
  • Archived Customer Records Management
  • Digital Certificate Issuance and Lifecycle Management
  • Customer PII and Identity Document Storage
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

Confirmed unauthorized read-only access to archived customer records containing full PII including names, business email addresses, phone numbers, and business mailing addresses. A subset of affected customers also had government-issued identity documents exposed, including driver's licenses, passports, and utility bills submitted during certificate validation workflows. The access window spanned June 27 to July 2, 2026. The total number of affected individuals was not publicly disclosed at time of reporting. No certificate issuance systems, CertCentral, DigiCert ONE, or customer login credentials were compromised. Financial exposure is unquantified at this stage but regulatory notification obligations under GDPR, CCPA, and other data protection frameworks could result in significant fines and remediation costs given the inclusion of government-issued identity documents.

Recommended Actions

  • • Enforce Zero Trust Segmentation (CNSF) to ensure internal business systems are never directly reachable from the internet; identity-based access policies and microsegmentation would have prevented the exposed system from being accessible without valid VPN or zero trust network access credentials, blocking initial compromise at the network layer.
  • • Deploy Egress Security & Policy Enforcement to detect and block unauthorized outbound data transfers; FQDN-based egress filtering and data exfiltration controls aligned with ZTMM.Data and NIST.800-53.SC-18 would have flagged or blocked the bulk read-only extraction of archived customer records to external destinations.
  • • Implement Multicloud Visibility & Control to establish continuous traffic observability and anomaly detection across hybrid environments; centralized control plane monitoring aligned with ZTMM.CrossCutting.Visibility and NIST.800-53.AU-6 would have detected anomalous self-registration activity and repeated read access patterns months earlier than October 2026.
  • • Apply East-West Traffic Security controls to restrict workload-to-workload and service-to-service access within the environment; even if the system was externally exposed, internal segmentation policies aligned with ZTMM.Network and NIST.800-53.SC-7 would have limited the authorization flaw's blast radius by preventing cross-system data access escalation.
  • • Leverage Cloud Firewall (ACF) capabilities to enforce least-privilege internet egress and inbound access controls; URL filtering and AI-assisted discovery of unexpected inbound traffic patterns aligned with NIST.800-53.SC-7 and ZTMM.Network would have detected the anomalous public exposure of the internal system during or immediately after the February 2025 migration.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image