DigiCert Discloses Breach of Internal System Tied to Migration Error

En bref

• DigiCert says an internal business platform was compromised after a migration left it accessible from the internet.
• Unknown intruders reached customer records and identity documents; the number of affected people is not disclosed.
• The company is notifying customers and has not cited a software vulnerability or CVE.
• Admins should review migration hardening, external exposure, and access logs.

DigiCert has reported that an internal business platform was breached after a server relocation introduced a configuration mistake. The flaw left the system reachable from the public internet, and unidentified parties used that access to get into the environment. No CVE or product vulnerability has been named; the issue appears to be a deployment and exposure problem rather than a software bug.

The intruders reached records belonging to customers, including identity documents. DigiCert has begun contacting customers about the incident. The total number of affected individuals or records has not been made public, so the full scope remains unclear.

This matters because certificate authorities and similar vendors hold sensitive trust data, and exposed identity documents raise fraud and account-takeover risks. Even an internal system can become high impact when it is reachable from the open internet. Migration windows are a common source of this kind of mistake, especially when firewall rules, load balancers, or cloud security groups are changed.

Because no CVE is involved, patching alone would not have caught the problem. The incident points to the need for asset inventories, external attack-surface checks, and change-review controls around server moves. Watch for updates on the number of affected customers, details of the notification process, and whether DigiCert identifies how long the system was exposed or how quickly access was detected.

À faire maintenant

1. Immediately audit all systems moved during recent server migrations for public exposure; remove unnecessary internet access and restrict access to VPN or allowlisted networks.
2. Rotate credentials, API keys, session tokens, and certificates associated with the exposed platform; invalidate active sessions.
3. Preserve and review logs for the migration window and afterward; identify anomalous access to customer and identity-document stores.
4. Enforce least privilege and network segmentation for internal business systems, and require migration checklists that include exposure review.
5. Scan external attack surfaces and cloud security-group rules for unintended public endpoints, then remediate misconfigurations.
6. Prepare and execute customer notification according to legal and privacy obligations, with guidance on identity-document fraud risks.
7. Add monitoring and alerting for new public exposures and suspicious access attempts against internal platforms.

Source originale

BleepingComputer