# DigiCert says exposed system let intruder access archived customer records

- URL: https://talkfuse.com/story/digicert-admits-16-month-security-lapse-exposed-customer-information/
- Published: 2026-11-06T13:15:00+00:00
- Updated: 2026-11-06T13:34:15+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/11/06/digicert-admits-16-month-security-lapse-exposed-customer-information/5308097
- Topics: Software

## Key points

- A migration exposed DigiCert’s internal system for over 16 months.
- An unauthorised account accessed a subset of archived records.
- Some records included identity documents; the number affected is unknown.

## Summary

A server migration left a DigiCert internal system exposed to the internet for more than 16 months, and an unauthorised user accessed archived customer records. The breach matters because some records included identity documents such as passports and driving licences, though DigiCert has not said how many people were affected.

The system was moved from a VPN-protected network in February 2025, and a self-registration feature let outsiders create accounts without multifactor authentication. DigiCert found unauthorised accounts on 18 June 2026, disabled self-registration on 2 July, and later confirmed that one account accessed some records between 27 June and 2 July. The company says its certificate services, customer credentials and issued certificates were unaffected; it has tightened network access and added monitoring.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.