Follow us on Google News
NEW DELHI — Digital certificate authority and cybersecurity provider DigiCert has suffered a data security breach after attackers exploited an exposed internal business platform to access sensitive enterprise customer information. Unauthorized actors registered an account through an administrative self-registration feature lacking multi-factor authentication, using the profile to inspect legacy contact records containing customer names, email addresses, phone numbers, and company addresses. In several instances, personal details recorded on government-issued identification papers submitted during corporate verification processes, including driving licences, passports, and utility bills, were also accessed by the intruders.
Configuration Lapse Leaves Internal Database Exposed
The security incident originated within an internal business system used by the enterprise to store legacy customer records. During February 2025, technical teams transferred the database into a different network segment, inadvertently exposing the platform directly to the public internet without intended perimeter safeguards. This misconfiguration created an ingress point that external actors subsequently identified and probed.
Investigative findings revealed that the attackers targeted the self-registration mechanism housed within the system’s account manager. Originally built for administrative convenience without requiring multi-factor authentication, the mechanism allowed external intruders to generate a valid read-only profile. Armed with this unauthorized access, the actors queried and reviewed stored business customer archives over a six-day window between June 27 and July 2.
Delayed Discovery and Investigation of Record Intrusion
Company administrators detected and disabled the unauthorized profile on July 2, initially categorizing the event as an isolated account-creation anomaly before closing immediate remediation steps. However, internal concerns surfaced in October that the fraudulent account might have been used to inspect archived customer documentation. DigiCert launched a comprehensive forensic inquiry on October 12, which subsequently confirmed that external actors had actively reviewed stored business contact data.
The company has not disclosed the total number of enterprise customers affected by the breach, nor has it detailed how many individual identity papers were compromised. The exposed data sets included formal verification documents submitted during routine commercial validation, specifically driving licences, passports, and residential or business utility bills. These files contained personally identifiable details, raising concerns regarding downstream risks such as targeted phishing attacks, identity theft, and tailored business fraud.
Certificate Operations Isolated Amid Security Overhaul
DigiCert emphasized that the affected internal database operated strictly with read-only permissions, preventing attackers from modifying records, approving customer validations, or tampering with cryptographic services. The company confirmed that its Certificate Authority infrastructure runs within isolated, highly protected network segments entirely segregated from the breached business platform, ensuring that primary digital certificate issuance operations remained uncompromised throughout the incident.
Since mid-October, the cybersecurity firm has introduced strict security measures to prevent recurrence. Technicians disabled the vulnerable self-registration feature, reset all user passwords across the business platform, and audited non-company accounts to verify or purge unauthorized credentials. DigiCert also deployed enhanced threat-monitoring alerts, reconfirmed system ownership protocols, and enforced access control policies to ensure that authenticated permissions remain aligned with operational requirements across all internal network assets.
