DigiCert Archive Exposure via Unauthenticated Self-Registration Reveals 2025 Migration Control Failure

The breach originated when an archiving platform containing business customer records was shifted to a new network segment without adequate segmentation or authentication controls. Attackers exploited a self-registration feature lacking MFA to generate a read-only account, pulling names, emails, phone numbers, addresses, and in some cases driver's licenses or passports. DigiCert detected the account on July 2 but only confirmed data access during an October investigation, indicating delayed forensic review of read operations.

Contract and procurement records show DigiCert manages high-volume certificate issuance for enterprises; exposure of validation contact data directly threatens certificate renewal workflows and opens targeted phishing vectors against operations teams. The incident aligns with prior CA misconfigurations where auxiliary systems were treated as lower-risk despite holding identity artifacts required for domain control validation.

Remediation steps announced in October—password resets, self-registration deactivation, and permission audits—address symptoms rather than the underlying practice of moving archival stores without enforced zero-trust boundaries. No evidence indicates CA signing infrastructure was reached, yet the contact list enables follow-on social engineering against the same customers.

Business customers should expect increased spear-phishing volume within 90 days and must rotate any DigiCert-linked validation contacts immediately.