DigiCert Migration Error Exposed Customer IDs and Passports for Five Days

The Bugzilla post-mortem states the system was treated as an infrastructure change rather than a security change, bypassing review and alerting for new account creation. No certificate issuance capability or customer credentials were reached, yet the database contained documents used for customer verification. This matches patterns seen in prior CA and PKI misconfigurations where operational moves created persistent exposure windows without triggering monitoring thresholds.

Mozilla, Google, Microsoft and Apple root-program rules classify the event as reportable because it involved unauthorized access to a certificate authority’s customer records. The absence of volume or anomaly detection on the newly exposed endpoint allowed five days of undetected queries. Official statements emphasize no observed misuse, yet the technical trail shows the migration removed intended network segmentation without equivalent controls.

Previous incidents at other trust-service providers demonstrate that identity documents linked to certificate subjects create durable linkage risks even when signing keys remain untouched. DigiCert’s post notes insufficient request-volume alerting; similar gaps preceded credential-stuffing and enumeration attacks on exposed admin portals in 2023–2024 CA disclosures.

Law-enforcement notification has been made, but root programs will likely require evidence of enhanced change-control and monitoring before the next audit cycle. Expect follow-up disclosures if additional query logs are recovered.