decrypted · 6 november 2026 · supply chain · uk policy and law · surveillance and privacy

DigiCert's archived customer data sat behind a door nobody checked

DigiCert, whose certificates put the padlock in your browser, has told customers that a business system holding archived customer records sat reachable from the internet for about 17 months, and that outsiders read some of it over five days. The company's own incident report blames a routine server migration. DigiCert says no certificates were issued or altered. Nothing in it needed a clever attacker.

What actually happened

In February 2025 DigiCert moved an internal business system from a network segment reachable only over a VPN to a different availability zone, which made it reachable from the internet. The system carried a self-registration feature meant for other uses, so anyone could create an account. Those accounts skipped the multi-factor authentication, a second check on top of the password, that DigiCert normally requires. They were read-only, but an authorisation flaw let them read archived customer data.

Think of moving a filing room from inside a locked office suite to a unit on the high street. The cabinets are unchanged, but the suite's front door was the only lock that mattered, and nobody checked the new door had one.

What the defender saw

Staff noticed unfamiliar accounts on 18 June 2026 and concluded they could not reach customer data. They put a web application firewall, a filter in front of a website, in front of the system to block new sign-ups. The root cause was found on 30 June and the fix shipped on 2 July. But DigiCert's report says the incident "was initially handled as an account-creation issue rather than a data-access event." Data access had run from about 27 June to 2 July. DigiCert first suspected it on 12 October and confirmed a reportable event on 19 October.

What was exposed

Mostly business contact details: names, business emails, phone numbers and addresses. A small minority of customer accounts also held a customer-provided document such as a driving licence, passport or utility bill. DigiCert has not published how many customers are affected, and says it is still reviewing documents to work out who to notify. Treat the identity documents as the real exposure: a business email can be changed, a passport cannot.

The Secure by Design lesson

DigiCert names three root causes: the network change had no security review, monitoring and alerting were insufficient, and the authorisation model did not account for self-registration. Network changes now need security sign-off, and file-access and request-volume alerts went live on 15 October.

Each fix is a decision that could have been made before the migration. A network boundary was doing the job of access control, so when the boundary moved, nothing else was left. Secure by Design means a system that stays safe when someone exposes it by accident. Ask your own teams what the last system they moved quietly relied on, and whether you still hold archived identity documents you no longer need. Data you have deleted cannot be read through a forgotten door. Opinion, not advice.

Also this week

A poisoned update channel at a security vendor. OpsShield, which makes the cPGuard server security tool, said attackers pushed a fake update to its customers on Monday 2 November. Affected versions are 5.88.12 through 5.88.19. The vendor's advisory says fixed releases start at 5.88.25, while its fuller disclosure names 5.88.26 as the clean update, so take the later one. The script ran as root and uploaded password hashes, root SSH keys (SSH is the encrypted way administrators log in to servers) and database credentials, and left a backdoor shell behind. The vendor puts the affected servers at about 2,950 and says it detected the problem within 12 hours; those are its own estimates. Its disclosure says the attacker registered as a customer, broke into the billing portal and took the keys used to publish updates. The design lesson is blunt: a tool that runs as root and installs whatever its update channel offers makes that channel the most valuable target the vendor owns. If you run cPGuard, or buy hosting from someone who does, ask whether any server installed those versions, and rotate every credential on it.

Regulators tell firms the AI is not an excuse. On 30 October the Digital Regulation Cooperation Forum, which brings together the Competition and Markets Authority, the Financial Conduct Authority, the Information Commissioner's Office and Ofcom, published a joint statement on personal AI agents, the assistants that buy things and write to businesses on your behalf. It creates no new rules. It says existing competition, consumer, data protection, online safety, financial services and cyber security law already applies, and that "an AI agent's autonomy does not diminish the responsibility of organisations that deploy it." It also asks firms to think about how authority to act is given and who is accountable for an agent's decisions. Read that as a warning to anyone wiring agents into customer journeys: decide in advance who authorised the agent, what data it sees and how a customer gets redress.

Sources

If you want a second pair of eyes on how your systems would cope with a quiet change like this, get in touch.