DigiCert’s incident report describes an archive exposure that began with a February 2025 migration. An internal system became internet-accessible; an unintended registration feature created accounts without MFA that could read archived data. This is a retrospective on a disclosed incident, checked on November 8, 2026. DigiCert’s full report.
DigiCert places unauthorized data access between June 27 and July 2, 2026, when an authorization patch closed the path. It confirmed the breach on October 19. The company says contact details and, in some cases, identity documents were involved; CA services and certificates were unaffected. Its public report gives no affected-person count. Staff initially assumed accounts without application assignments could not reach data. Incident timeline and impact.
A valid account still needs permission
The useful distinction is between proving who a user is and deciding what that user may read. OWASP’s authorization guidance treats these as separate decisions: applications should start from denial, grant only required access and check permissions on every request. A successful login, a read-only role or an internal hostname cannot establish entitlement to a customer’s records.
For teams reviewing an archive, build an access matrix around actual documents and operations. Include ordinary staff, newly registered users, accounts without application assignments and users from another customer. Test downloads and API endpoints directly, rather than checking only whether menus disappear. Repeat those checks after network or identity-provider changes. OWASP also recommends covering static resources and retaining useful authorization logs; a protected dashboard is insufficient if its files have a separate route.
The security consequence is confidentiality, even when the application prevents writes. Treat the ability to retrieve a sensitive record as a permission that must be justified. That makes archive access a concrete review question, instead of a reassuring assumption about where the server lives.
Keep the evidence boundary visible
Later comments say affected customers were contacted and all listed remediation tasks completed. These are DigiCert’s statements; the public thread provides no independent forensic assessment. Remediation update; customer-notification update.
