--- title: DigiCert admits 16-month security lapse exposed customer... description: A botched server migration exposed a DigiCert internal system to the public internet for more than 16 months, letting an unauthorized user access customer... canonical: https://daily.dev/posts/digicert-admits-16-month-security-lapse-exposed-customer-information-hglm5cbgj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: DigiCert admits 16-month security lapse exposed customer information | daily.dev og:description: A botched server migration exposed a DigiCert internal system to the public internet for more than 16 months, letting an unauthorized user access customer... og:url: https://daily.dev/posts/digicert-admits-16-month-security-lapse-exposed-customer-information-hglm5cbgj og:image: https://api.daily.dev/og/posts/hglM5cBgj.png og:image:alt: DigiCert admits 16-month security lapse exposed customer information og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # DigiCert admits 16-month security lapse exposed customer information **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 0 upvotes · 0 comments ## Summary A botched server migration exposed a DigiCert internal system to the public internet for more than 16 months, letting an unauthorized user access customer records including names, business email addresses, phone numbers, business addresses, and in some cases passports, driver's licenses, and utility bills. The issue began in February 2025 when the system was moved from a VPN-protected network to a different availability zone. DigiCert found unauthorized accounts on June 18, 2026 but initially dismissed them as harmless, and it took until July 2 to shut down the account creation issue after a researcher raised the alarm. It later confirmed an unauthorized account accessed a subset of archived records between June 27 and July 2. Certificate authority operations, CertCentral, and DigiCert ONE were unaffected, and the company found no evidence the unauthorized account was used to issue, revoke, or validate certificates. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What caused the DigiCert data breach that exposed customer passports and IDs? A botched server migration in February 2025 moved an internal business system off a VPN-protected network, accidentally exposing it to the public internet for more than 16 months. The system shared an account management platform with DigiCert's customer-facing products, including a self-registration feature that let outsiders create accounts without multifactor authentication and browse archived customer records due to a separate permissions flaw. _Teams assessing vendor breach risk can track incident disclosures like this one on daily.dev._ ### How long was the unauthorized account active in DigiCert's systems before it was shut down? DigiCert found unauthorized accounts on June 18, 2026 but initially dismissed them as harmless since they weren't tied to an application. A security researcher raised the alarm three days later, but DigiCert didn't shut the issue down until July 2. It later confirmed an unauthorized account accessed archived records between June 27 and July 2. _Anyone triaging security alerts can compare response timelines like this one on daily.dev._ ### Were DigiCert certificates or certificate authority operations affected by the 2026 breach? No, certificate authority operations, CertCentral, and DigiCert ONE were unaffected. Customer credentials and issued certificates remain secure, and DigiCert found no evidence the unauthorized account was used to issue, revoke, or validate certificates. The exposure was limited to an internal archive containing identity documents like passports and driver's licenses. _Developers relying on a CA's integrity can follow breach scope details like this on daily.dev._ ## Similar posts on daily.dev - [Another massive data breach exposed millions of driver’s license numbers](https://daily.dev/posts/another-massive-data-breach-exposed-millions-of-driver-s-license-numbers-z6spff7ie) · TechCrunch · 0 upvotes · 0 comments - [1.2 Million Bank Accounts Exposed in Financial Systems Breach](https://daily.dev/posts/1-2-million-bank-accounts-exposed-in-financial-systems-breach-flccsxygb) · Security Boulevard · 0 upvotes · 0 comments - [America's Driver's License Breach Is a National Security Disaster](https://daily.dev/posts/america-s-driver-s-license-breach-is-a-national-security-disaster-mxhj7woat) · Tech Lead Digest · 0 upvotes · 0 comments - [Telco giant KDDI says data breach affects over 12 million people](https://daily.dev/posts/telco-giant-kddi-says-data-breach-affects-over-12-million-people-mu8uzzc5b) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#data-breach](https://daily.dev/tags/data-breach), [#identity-theft](https://daily.dev/tags/identity-theft) [View this post on daily.dev](https://daily.dev/posts/digicert-admits-16-month-security-lapse-exposed-customer-information-hglm5cbgj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"DigiCert admits 16-month security lapse exposed customer information","url":"https://daily.dev/posts/digicert-admits-16-month-security-lapse-exposed-customer-information-hglm5cbgj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/digicert-admits-16-month-security-lapse-exposed-customer-information-hglm5cbgj"},"datePublished":"2026-11-06T13:16:44.963Z","dateModified":"2026-11-06T13:17:55.830Z","description":"A botched server migration exposed a DigiCert internal system to the public internet for more than 16 months, letting an unauthorized user access customer...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7fd52423c1e35ac60ac82a6c43fd6e9f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7fd52423c1e35ac60ac82a6c43fd6e9f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/digicert-admits-16-month-security-lapse-exposed-customer-information-hglm5cbgj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"data-breach,identity-theft","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"DigiCert admits 16-month security lapse exposed customer information"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/digicert-admits-16-month-security-lapse-exposed-customer-information-hglm5cbgj#faq","mainEntity":[{"@type":"Question","name":"What caused the DigiCert data breach that exposed customer passports and IDs?","acceptedAnswer":{"@type":"Answer","text":"A botched server migration in February 2025 moved an internal business system off a VPN-protected network, accidentally exposing it to the public internet for more than 16 months. The system shared an account management platform with DigiCert's customer-facing products, including a self-registration feature that let outsiders create accounts without multifactor authentication and browse archived customer records due to a separate permissions flaw. Teams assessing vendor breach risk can track incident disclosures like this one on daily.dev."}},{"@type":"Question","name":"How long was the unauthorized account active in DigiCert's systems before it was shut down?","acceptedAnswer":{"@type":"Answer","text":"DigiCert found unauthorized accounts on June 18, 2026 but initially dismissed them as harmless since they weren't tied to an application. A security researcher raised the alarm three days later, but DigiCert didn't shut the issue down until July 2. It later confirmed an unauthorized account accessed archived records between June 27 and July 2. Anyone triaging security alerts can compare response timelines like this one on daily.dev."}},{"@type":"Question","name":"Were DigiCert certificates or certificate authority operations affected by the 2026 breach?","acceptedAnswer":{"@type":"Answer","text":"No, certificate authority operations, CertCentral, and DigiCert ONE were unaffected. Customer credentials and issued certificates remain secure, and DigiCert found no evidence the unauthorized account was used to issue, revoke, or validate certificates. The exposure was limited to an internal archive containing identity documents like passports and driver's licenses. Developers relying on a CA's integrity can follow breach scope details like this on daily.dev."}}]} ```