An update to my DigiCert breach post, with more from The Register.
What’s new
- The internal archive sat on the public internet for more than 16 months after a February 2025 migration
- Self-registration (never meant for that system) plus a permissions flaw let outsiders create accounts without MFA and browse archived records
- Unauthorized accounts were found June 18, but DigiCert first treated it as an account-creation issue. A researcher flagged it June 21; access was shut July 2
- Only on October 19 did DigiCert confirm an unauthorized account had accessed a subset of records between June 27 and July 2
- Exposed data can include names, business emails, phones, addresses, and for some people passports, driver’s licenses or utility bills. DigiCert hasn’t said how many people were hit
My take
Sixteen months of accidental exposure is the story. If DigiCert notifies you, treat identity docs as burned and watch for targeted phishing.
God Bless, and Use the Source!
