A certificate authority serving thousands of hospitals with certificates for portals, APIs and device identity left an internal business system open to the internet for sixteen months. Its records included the identity documents customers submitted to prove who they were.
The origin is a February 4, 2025 migration that shifted the business system off a VPN-fenced segment, with the new placement reviewed by nobody. Sign-up on the box was self-service, so outsiders built accounts that the multifactor authentication DigiCert enforces on its own staff never covered. Attached to no application they still read archived customer records, on the strength of an authorization bug.
How the exposure went unnoticed
On June 18, 2026, DigiCert staff saw accounts on the box that did not belong to the company, and reasoned that empty applications meant no data reach. Three days on, a researcher said outsider sign-ups remained possible, prompting an authorization patch dated July 2. DigiCert read the alarm as account creation rather than data access. Archived-data access was first suspected October 12 and confirmed October 19.
Records covered names, work emails, phone numbers and addresses, plus driver’s licenses, passports or utility bills for some people. No figure for affected individuals has been released. The intruding account, it says, could only read, and no issuance or revocation work has been linked to it. Customers keep their current certificates.
Healthcare organizations are unusually exposed here, because their certificates are often validated through organizational identity documents naming executives and compliance officers. Those are exactly the records now in scope. Ask your PKI owners which verification packets went to each certificate authority, and whether the CA confirmed your organization records were untouched. The failure itself is instructive: a VPN boundary removed during a migration, self-registration left enabled, and an authorization check nobody tested from the outside.
