DigiCert breach: HTTPS certificate authority committed, identity documents of employees stolen
The internet trust was compromised.
DigiCert, the certification authority that issues certificates for HTTPS to protect billions of daily transactions on the internet, was hacked.
Not only were stolen credentials. Not only was exposed customer information.
They were stolen identity documents of employees.
This is a security gap that goes beyond ‘data breach’. It is a violation of the chain of trust from the internet.
The severity of the issue
What is DigiCert
DigiCert is a certificate authority of SSL/HTTPS. Issues digital certificates that:
- Protect online transactions
- Verify the identity of web sites
- They are the basis of trust in the internet
If you trust that a website is legitimate when you see ‘https://’, it is because DigiCert (or similar authority) has verified that it is true.
What was stolen
FACT (according to This Week in Security):
Hackers committed DigiCert and stole:
- Customer information
- Identity documents of employees
- Possibly credentials of internal systems
How it happened
FACT: A server migration 2025 was left publicly exposed on the internet.
The server contained access to critical systems. The attackers found, exploited, and escalated from there.
Specific gravity
Level 1: Data of employees
If identity documents of employees were stolen:
- Sensitive personal information is in the hands of criminals
- Risk of identity theft for employees
- Information that can be used for targeting/social engineering the future
- Individual privacy completely committed
Level 2: Chain of trust
If a certificate authority is compromised, potentially:
- Attackers could have accessed generation systems certificate
- Attackers might be able to generate fraudulent certificates
- These certificates could be used to impersonate legitimate sites
- Users would be seeing ‘https’ in the malicious sites, believing they are safe
This would be the worst possible scenario for security on the internet.
Level 3: global Implications
DigiCert issued certificates for companies and governments worldwide. If your infrastructure was compromised:
- Banks
- Governments
- Health enterprises
- Critical infrastructure
All potentially had their certificates committed.
Why it was possible to
Vulnerability 1: Server migration exposed
FACT: A server migration 2025 was left publicly exposed.
This means:
- Lack of inventory of servers
- Lack of monitoring of public exhibitions
- Lack of cleanup after migration
Vulnerability 2: Access from the server committed
If the migration server had access to critical systems:
- Lack of network segmentation
- Lack of principle of least privilege
- A server is not critical could gain access to critical systems
Vulnerability 3: Lack of detection
The server was exposed for more time than necessary before being discovered.
How to 24Cevent would have caught this
If DigiCert had detection of anomalies in your infrastructure:
Detection of server exposed
When the migration server was left exposed (2025):
- Network: Server accessible from the internet without a firewall
- Correlation: the Server should not be exposed
- Action: auto-Lock + notice
The server would never have been publicly exposed.
Detection of access anomalies
When attackers attempt to exploit the server:
- Access: Multiple attempts of login failed
- Escalation: Access to directories is not authorized
- Correlation: Pattern recognition
24Cevent: ‘INTRUSION ATTEMPT DETECTED’ + lock
Detection of lateral movement
If the attackers manage to initial access:
- Movement: Since the server migration to critical systems
- Correlation: Access to certification systems without authorization
- Analysis: Escalation of privileges detected
24Cevent: ‘POST-COMPROMISE, LATERAL MOVEMENT DETECTED’ + isolation immediately
The critical lesson
This incident proves that:
- Not even the certification authorities that protect the internet have defenses adequate
- The chain of trust of the internet is based on companies that make basic mistakes of safety
- A server forgotten can compromise the whole internet
If DigiCert was compromised in this way, any business may be compromised in the same way.
The defense is not ‘better passwords’ or ‘firewalls’.
The defense is automated anomaly detection that detects and blocks in real time, before damage occurs.
SOURCES CHECKED: