Skip to content
securitytabs

LiveUpdated

DigiCert says a server migration error exposed customer data and identity documents

Certificate provider DigiCert says an internal business system was left open to the internet by mistake, and an unauthorized person accessed customer information. Affected customers are being notified; the company has not said how many.

DigiCert customer data exposed by a server migration error
DigiCert customer data exposed by a server migration error

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

DigiCert says a mistake during a server migration left an internal business system exposed to the internet, allowing unauthorized access to customer information and identity documents. [1][2]

The Register reports the exposure lasted more than a year, which it puts at 16 months, and that the data included passports and driver's licenses. [2]

What data was accessed

SecurityWeek reports that an intruder created an account on the internal system and accessed names, email addresses, phone numbers and business addresses of business customers. [3]

What is not yet known

DigiCert has begun notifying affected customers but has not disclosed how many people or organizations had their information exposed, according to The Register. The sources reviewed do not say who accessed the system or whether the data has been misused. [2][1]

Timeline

  1. DigiCert's disclosure said an intruder created an account on the exposed internal system. [3]

  2. DigiCert had begun notifying affected customers. [2]

  3. DigiCert disclosed a data breach caused by a server migration mistake. [1]

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

If you bought certificates from DigiCert, your contact details or identity documents may have been in the exposed system. DigiCert has begun notifying affected customers. [2][3]

What to do

  1. Watch for a notice from DigiCert and read it for what was exposed. [2]
  2. Ask your IT provider whether your organization is a DigiCert customer. [1]

Mid-size company

A small IT or security team

What to know

Business customers' names, email addresses, phone numbers and business addresses were accessed, and identity documents were exposed, according to the coverage. The number of people affected has not been disclosed. [3][2]

What to do

  1. Confirm whether your organization has DigiCert accounts and whether identity documents were submitted for validation. [1]
  2. Watch for DigiCert's notification and its guidance on the exposed data. [2]

Large enterprise

A security operations team

What to know

The exposure came from a migration error rather than a reported flaw in DigiCert's certificate products. No mitigation steps have been published in the sources reviewed. [1][2]

What to do

  1. Identify teams and subsidiaries holding DigiCert accounts and the identity documents they supplied. [2]
  2. Watch for DigiCert's notification to customers about the exposed data. [2]

Sources

  1. [1]BleepingComputer · Nov 5, 16:12 UTC
    DigiCert data breach exposes customer information, identity documentscontext
  2. [2]The Register Security · Nov 6, 13:15 UTC
    DigiCert admits 16-month security lapse exposed customer informationcontext
  3. [3]SecurityWeek · Nov 6, 14:00 UTC
    DigiCert Data Breach Impacts Business Customer Informationcontext