DigiCert server migration leaked customer identity documents for 513 days

Key facts

Infrastructure migration and 513-day exposure lifecycle

On Thursday 5 November 2026, commercial certificate authority DigiCert submitted a formal security incident report under Bug 2084460 on Mozilla's Bugzilla platform. The filing disclosed that an internal system containing archived customer validation records was inadvertently exposed to the public internet for 513 days following an unreviewed infrastructure migration (derived: ~16.9 months, derived).

The failure originated on 4 February 2025 when systems operations teams migrated a legacy internal business application from a VPN-restricted corporate network segment into a multi-tenant cloud availability zone. Because the relocation was handled as a routine infrastructure task rather than a security architecture change, perimeter security controls were not reassessed. Web Application Firewall (WAF) routing rules failed to restrict the application hostnames to corporate VPN traffic, leaving the system directly reachable across public IP networks.

Zoom

Key chronological milestones of the DigiCert archive exposure

Date	Incident Milestone	Technical Operational Detail	Lifecycle Significance
4 February 2025	Infrastructure Migration	Internal archive moved out of VPN-restricted segment into cloud zone	Origin of public internet exposure
27 June to 2 July 2026	Unauthorized Data Access	Actor creates account and queries customer verification archives	6-day active breach window (derived)
2 July 2026	Perimeter Remediation	WAF access restricted to VPN following bug bounty submission	Exposure terminated after 513 days (derived)
19 October 2026	Forensic Confirmation	Access log review confirms customer records were actively queried	109-day delayed triage interval (derived)
5 November 2026	Public Notification	Bugzilla 2084460 disclosure and customer notification letters sent	639 days from initial migration (derived)

The exposure was remediated on 2 July 2026 after an independent security researcher reported through DigiCert's managed bug bounty program that external users could register accounts on the internal interface. However, DigiCert initially treated the incident exclusively as an account-creation flaw, delaying in-depth forensic log analysis by more than three months.

Shared authentication and authorization flaw mechanics

The breach was made possible by an architectural coupling between internal business tooling and customer-facing commercial portals. The exposed archive system shared an identity and account management framework with DigiCert's public web products, which supported open self-registration.

Zoom

When an external visitor created an account on the public interface, the identity service generated an authenticated profile. Under normal design, unassigned accounts possessed zero privileges. However, an authorization logic flaw in the internal archive application granted default global read-only permissions to any valid authenticated account token, regardless of role bindings. The actor was consequently able to execute queries and view archived subscriber records.

Architectural breakdown of the authorization failure cascade

Architectural Layer	Intended Security State	Actual Production State	Exploitation Outcome
Network Perimeter (WAF)	Restrict hostname to corporate VPN IP ranges	Host routed publicly to open internet	External TCP connections permitted
Identity Management	Authenticate corporate employees via enterprise MFA	Shared public customer self-registration enabled	External accounts successfully registered
Application Authorization	Verify explicit application role assignments	Missing role check; default read access granted	Archived subscriber records viewable in read-only

Exposed customer records and core CA segregation

The compromised data involved archived records submitted by subscribers during validation for high-assurance certificates, such as Organization Validated (OV) and Extended Validation (EV) certificates. The exposed data fields included subscriber names, business email addresses, business telephone numbers, and physical business addresses.

Crucially, for certain verified individuals, the archive contained scanned identity verification documents. These included government-issued passports, driver licenses, utility bills, and corporate incorporation documents. Cloud architect Fabian Bader, an affected subscriber who received a notification letter, publicly shared the notification on X, noting that the compromised materials included his full personal identifiable information and validation paperwork.

Zoom

Cryptographic and infrastructure integrity assessment

Operational Domain	Security Architecture	Compromise Assessment	Trust Anchor Integrity
Legacy Archive Business System	Cloud VM migrated from VPN	Compromised (Read-only data access)	Subscriber PII and identity documents leaked
CA Root & Intermediate Signing Keys	Hardware Security Modules (HSMs)	Unaffected (Zero access)	100 percent cryptographic validity maintained
Commercial Portals (CertCentral)	Segregated enterprise production network	Unaffected (Zero access)	Customer passwords and API credentials safe
Issued Digital Certificates	Cryptographically signed x509 chains	Unaffected (No misissuance)	Zero certificate revocation required

DigiCert confirmed that the threat actor possessed strictly read-only access. The attacker could not alter existing subscriber records, approve pending validation requests, generate new private keys, or trigger unauthorized certificate issuance. All active TLS, S/MIME, and Code Signing certificates remain cryptographically valid and untampered.

Remediation and enterprise cloud migration lessons

Following forensic confirmation on 19 October 2026, DigiCert reinforced access controls across all internal environments. Systems engineering teams disabled public self-registration on internal identity endpoints, enforced strict network perimeter ingress policies at the WAF, and deployed automated configuration drift monitors to verify VPN segregation.

Implemented corrective controls and defensive hardening

Domain	Remediation Action	Technical Safeguard	Verification Cadence
Perimeter Governance	Strict WAF ingress filtering	Block non-VPN IP traffic to all internal hostnames	Continuous automated scanning
Identity Architecture	Disable open self-registration	Enforce enterprise SSO and hardware MFA for internal tools	Immediate enforcement
Authorization Logic	Explicit positive role checks	Deny all access unless user possesses verified entitlement	Code-level unit tests
Incident Triage Protocol	Mandatory access log auditing	Audit data access on all bug reports involving account creation	Updated IR playbook

The DigiCert incident demonstrates that infrastructure migrations cannot be treated merely as operational plumbing. When legacy internal systems are transitioned to modern cloud platforms, failure to re-evaluate perimeter boundaries and shared identity frameworks can expose sensitive archival archives to global internet surveillance for months before discovery.