The Morning Dev

Only the news worth knowing

‹
 
B48/100

Breach · high

DigiCert data breach exposes customer information

Tier B · Patch this week – Put it in the sprint

Who’s exposed: DigiCert business customers with data on the exposed system

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Remote, no login · Secrets exposed

The Brief

  • DigiCert says an unauthorized user accessed customer data through an internal system.
  • The Register reports a botched server migration left the system exposed to the internet for more than a year (16 months).
  • SecurityWeek reports names, email addresses, phone numbers and business addresses were accessed; The Register reports passports, driver's licenses and other identity documents were also exposed.

Why it matters

Exposed contact details and identity documents can be used for targeted phishing and identity fraud against people and businesses tied to DigiCert accounts.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsJudgment: DigiCert is a certificate authority whose services developers and ops teams use daily.
NoCore infrastructureJudgment: A single certificate authority's internal system is not core infrastructure like OpenSSH or GitHub.
NoPopular toolJudgment: DigiCert is a widely used CA service, but this breach hit one company's internal system, not a mainstream tool.
YesExploited in the wildSecurityWeek: hackers created an account on an internal system and accessed customer information.
NoPublic exploitNeither source mentions published exploit code or a proof-of-concept.
YesRemote, no loginThe Register: internal system exposed to the internet allowed an unauthorized user to access customer data.
NoFull takeoverNeither source reports code execution, root/admin access or account takeover; only data access.
YesSecrets exposedThe Register: customer passports and driver's licenses exposed; SecurityWeek: names, emails, phone numbers, addresses accessed.
NoSupply chainNeither source reports malicious code shipped through a trusted channel or compromised package or update.
NoNo fix yetNeither source states whether a fix or patch has been released for the exposed system.

Timeline

  1. BleepingComputer

    DigiCert data breach exposes customer information, identity documents

  2. DigiCert admits the internal system was exposed to the internet for 16 months and customer data was accessed

  3. www.theregister.com - Articles

    DigiCert admits 16-month security lapse exposed customer information

  4. SecurityWeek

    DigiCert Data Breach Impacts Business Customer Information

Full coverage · 3 sources

First seen · 3 sources · Full story page · How tiers are decided