The IT Nerd

Certificate authority DigiCert has disclosed a data breach involving an internal business system that was inadvertently exposed to the internet for more than 16 months following a February 2025 network migration.

The system, previously restricted to VPN access, allowed an unauthorized user to create an account without multifactor authentication and access archived customer information. DigiCert discovered unauthorized accounts on June 18, 2026, but initially dismissed them as harmless because they weren’t assigned to an application.

Although the vulnerability was addressed on July 2, the company didn’t confirm until October 19 that customer records had been accessed between June 27 and July 2. Exposed information included names, business contact details and, for some customers, passports, driver’s licenses and other identity documents. The number of affected customers remains undisclosed.

Seemant Sehgal, Founder & CEO, BreachLock

“A system that was behind a VPN for years and then sat on the open internet for 16 months tells you the migration checklist had no step that asked what else this change exposes. This is how most of these exposures start. No one re-verified reachability after the move, so the control everyone assumed was in place had quietly stopped existing. When unauthorized accounts are dismissed because they weren’t tied to an application, it means the team judged risk by what the account was assigned to rather than what it could reach. That is how an exposure turns into a confirmed records breach four months later.”

ㅤ

John Strand, Owner, Black Hills Information Security

“Whenever I see articles like this, I get uncomfortable with the way information trickles out from the vendor, bit by bit by bit. Sometimes we don’t get a cohesive understanding of what happened until months later. This breach feels like that.

“First, there was a breach, but nothing sensitive was affected. Then, there was a breach, but we took care of it. Now we’re hearing that the exposure lasted more than 16 months.

“That pattern makes me question whether the slow release of information is intentional. I can’t say what the vendor’s intent is, but dribbling out details can bury a story. Something that would have been a very large story if disclosed all at once starts small and grows through updates that attract less attention.

“The story gets old. Writers and reporters end up covering what looks like the same incident again and again, even when the new information materially changes our understanding of it. That concerns me, because this is starting to look like a much larger breach than was initially reported..

“It’s either that, or they are very incompetent.”

ㅤ

Sharon Hagi, CSO, Finite State:

“Certificate authorities are the root of trust for the connected world. Billions of devices rely on them to prove who they are (identity), to authenticate each other (authentication and key exchanage), and to accept only genuine firmware updates (digital signatures). When a CA’s security fails, the damage can reach every system that trusts it.

“DigiCert says certificate issuance was not affected, and that matters. But this was not a sophisticated attack. It was a basic operational failure: a system was exposed for 16 months, accounts could be created without MFA, and confirming the breach took four months. The stolen identity documents are the same ones used to validate certificate holders, which gives attackers material for impersonation and social engineering. The fact that a certificate authority fell short in this case, is the material concern.

“CAs sit at the top of the trust hierarchy. They have to be held to a higher standard than anyone else in ecosystem, and they have to meet it.”

This is way too long to notify humans that you got pwned. And you have to question if people are paying attention. Especialy 16 months later.