What happened
In February 2025 DigiCert shifted an internal archive of customer business and personal information from a VPN‑protected environment to a publicly accessible network segment without a security impact assessment. The move exposed an account‑registration endpoint that allowed external parties to create accounts without multifactor authentication. Those accounts, though limited to read‑only access, enabled an attacker to download records containing names, business emails, phone numbers, addresses, and identity‑verification documents such as driver’s licences, passports, and utility bills. The intrusion was first detected by a managed‑security program in June 2026, fully understood a few days later, and mitigated in July 2026 by placing the archive behind a web‑application firewall, blocking external account creation, and adding SIEM alerts for blocked attempts.
Why it matters for trust and compliance
- The incident demonstrates that lacking MFA and a formal change‑review process can break access‑control objectives that map to multiple frameworks, highlighting the need for continuous evidence of control enforcement.
- Validate that all account‑creation pathways enforce MFA and least‑privilege access.
- Document change‑management reviews and retain evidence for audit readiness across frameworks.
Who is affected
Certificate authorities PKI SaaS providers Enterprises exposing internal services to external networks
Recommended actions
- Perform a security impact assessment for any network‑zone changes.
- Enforce MFA on all external‑facing account creation mechanisms.
- Implement continuous monitoring alerts for unauthorized access attempts.