DigiCert Sold Digital Trust. Then It Misread Its Own Alarm.
Bottom Line Up Front: DigiCert, a major issuer of the digital certificates that secure websites, has disclosed that an internal archive of customer records sat exposed to the internet for about 16 months. An outsider read part of that archive, which for some customers held passports and driver's licenses. The uncomfortable detail is this: DigiCert staff saw the intruder's accounts nine days before the data was read and judged them harmless. This was not a failure of tools. It was a failure of judgment, process, and data discipline.
What Happened, in Plain Terms
A certificate authority is a company that vouches for identity online. Before DigiCert places an organization's name inside a certificate, it checks who is asking. That check often requires customers to hand over proof: a business address, a phone number, and sometimes a passport, a driver's license, or a utility bill. DigiCert kept those records in an internal archive.
According to DigiCert's incident report, as described by BankInfoSecurity, The Register, and BleepingComputer, the sequence ran as follows:
February 2025: Engineers moved the archive system out of a network segment protected by a virtual private network. The move left it reachable from the public internet. No security review took place.
June 18, 2026: Staff noticed accounts on the system that did not belong to DigiCert. They concluded the accounts could not reach any data.
Days later: An outside researcher reported that anyone could create an account on the system.
June 27 to July 2, 2026: An unauthorized account read a portion of the archived records. DigiCert blocked it on July 2.
October 19, 2026: After a further investigation, DigiCert confirmed that customer information had been accessed.
Early November 2026: Affected customers began receiving notices.
DigiCert says its certificate systems, customer passwords, and issued certificates were not touched. The intruder's access was read-only. The company has not said how many people are affected, and it is still reviewing which identity documents were in the records that were read.
The Real Failure Was Not Monitoring
It is tempting to describe this as a monitoring failure. That reading is too generous in one respect and too harsh in another. DigiCert did detect the rogue accounts. What failed was the assessment that followed. In the words of the company's own root cause analysis, "the migration was treated as an infrastructure change rather than a security change." The same habit of mind appeared again in June, when the event was filed as an account problem and not as a possible data exposure.
The alarm rang on June 18. The data was read on June 27. The gap between those dates is the whole story.
Three ordinary weaknesses combined to produce the breach:
Change management. A network move changed who could reach the system, yet nobody asked what an outsider could now see.
Access control by location. The archive relied on the network perimeter to keep strangers out. Once the perimeter moved, a sign-up feature borrowed from customer-facing products let anyone register, without multifactor authentication.
Triage. Analysts saw unfamiliar accounts and closed the question on an assumption. Nobody tested whether those accounts could open records.
None of these is exotic. Every one of them exists today inside agencies, banks, hospitals, and universities.
Why Identity Documents Change the Stakes
A stolen password can be changed in a minute. A passport scan cannot. Identity documents hold their value to criminals for years, and they are the raw material for account takeover, fraudulent loans, and convincing impersonation. A security engineer quoted by BankInfoSecurity warned that a passport image paired with a utility bill comes close to what some help desks accept before resetting an account.
This raises the question DigiCert has not yet answered in public: why were those scans still sitting in an archive at all? Validation is a moment in time. Once identity is confirmed, the case for keeping the underlying document grows weaker with every passing month.
Data that is not kept cannot be stolen. Retention is a security decision, not a storage decision.
For organizations that sent staff documents to any vendor for verification, the practical steps are modest but worth taking:
Ask the vendor what it retains, for how long, and where.
Treat any message that claims to come from DigiCert with caution, and confirm it inside the official customer portal.
Advise affected employees to add a PIN or passphrase to bank and mobile carrier accounts.
The Case for DigiCert, Fairly Stated
Fairness requires the other side. DigiCert published a detailed root cause analysis on a public tracker used by web browser makers to oversee certificate authorities. Most breached companies never offer that level of candor. The machinery that issues certificates held firm. The access lasted six days and could not alter anything. DigiCert also says it has reported the matter to law enforcement and has seen no evidence of misuse.
Those points are real. However, they also sharpen the lesson. A company can protect its crown jewels with great rigor and still be undone by a back-office system that nobody classified as sensitive. Auditors examine the certificate systems closely. The archive of passports lived outside that spotlight.
An Analyst's View
Security leaders should resist the comfort of calling this a vendor's mistake. The pattern is universal: a routine infrastructure change, an inherited feature, an alert explained away, and a store of sensitive records that outlived its purpose. Moreover, the four months between blocking the account and confirming the data access show how slowly an organization moves once it has decided an event is minor.
For decision-makers in Washington, London, Brussels, Abuja, and elsewhere, the question to put to your own teams is simple. When someone last moved a system, who asked what it could now be reached by? And when an analyst last dismissed an odd account, who checked the reasoning?
How OSRS Can Help
OGUN Security Research and Strategic Consulting LLC provides intelligence analysis, security assessments, and strategic advisory services to government agencies, corporations, and institutions across the United States, Europe, and Africa. Our team helps organizations review change-management practices, identify internet-exposed internal systems, audit vendor handling of identity documents, and build data retention policies that reduce what an intruder can take. Contact us at contact@ogunsecurity.com to schedule a confidential consultation.
Enjoyed this article? Stay informed by following us on Google News, Twitter, and LinkedIn for more exclusive cybersecurity insights and expert analyses. Share this article with your network and subscribe to our email list for weekly intelligence briefings.
About the Author Dr. Sunday Oludare Ogunlana is the Founder and CEO of OGUN Security Research and Strategic Consulting LLC, Professor of Cybersecurity, national security scholar, and television commentator. He advises public and private sector leaders on cyber risk, intelligence, and digital investigations.
Intelligence. Protection. Strategy. www.ogunsecurity.com
Comments