{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/internal-customer-archiving-system/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Internal customer archiving system"],"_cs_severities":["high"],"_cs_tags":["data-breach","identity-theft","misconfiguration"],"_cs_type":"advisory","_cs_vendors":["DigiCert"],"content_html":"\u003cp\u003eDigiCert disclosed a data breach involving an internal system used to archive customer information. In February 2025, the system was moved to a different network segment, resulting in inadvertent exposure to the internet. Between June 27 and July 2, 2026, unauthorized actors exploited a self-registration feature in the system's account manager, which lacked multi-factor authentication (MFA), to create read-only accounts. This access allowed the exfiltration of customer names, email addresses, phone numbers, business addresses, and in some instances, identity documents including driver's licenses and passports. DigiCert confirmed that the core Certificate Authority (CA) systems were isolated on secure network segments and remained unaffected. The breach was remediated by deactivating the self-registration feature, verifying account ownership, and resetting passwords for all system users.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInternal archiving system was migrated to a new network segment (February 2025).\u003c/li\u003e\n\u003cli\u003eMigration error resulted in the internal system becoming exposed to the public internet.\u003c/li\u003e\n\u003cli\u003eAttackers identified the exposed system and its self-registration account creation feature.\u003c/li\u003e\n\u003cli\u003eAttackers created a read-only account using the self-registration feature, bypassing the need for MFA.\u003c/li\u003e\n\u003cli\u003eAttackers utilized the unauthorized account to access and exfiltrate archived customer data (June 27 to July 2, 2026).\u003c/li\u003e\n\u003cli\u003eDigiCert identified and blocked the unauthorized account (July 2, 2026).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eConfirmed compromise of business customer contact information, including names, email addresses, phone numbers, and business addresses. Select customers also had sensitive identity documentation (driver's licenses, passports, utility bills) exposed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit all internal systems moved during network segment migrations to verify they are not inadvertently exposed to the internet.\u003c/li\u003e\n\u003cli\u003eDisable self-registration features on internal-only systems; if required, gate registration behind robust multi-factor authentication (MFA).\u003c/li\u003e\n\u003cli\u003eImplement monitoring for administrative or account-creation events on internal systems to detect unauthorized account provisioning.\u003c/li\u003e\n\u003cli\u003eReview and tighten network segmentation policies to ensure internal archiving and administrative tools are not reachable via external interfaces.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T14:28:07Z","date_published":"2026-11-06T14:28:07Z","id":"https://feed.craftedsignal.io/briefs/2026-11-digicert-data-breach/","summary":"Unauthorized actors exploited a publicly exposed internal customer archiving system with an insecure self-registration feature to access sensitive business customer contact information and identity documents.","title":"DigiCert: Data breach via exposed internal archiving system","url":"https://feed.craftedsignal.io/briefs/2026-11-digicert-data-breach/"}],"language":"en","title":"CraftedSignal Threat Feed - Internal Customer Archiving System","version":"https://jsonfeed.org/version/1.1"}