Internal Customer Archiving System - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/internal-customer-archiving-system/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 14:28:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDigiCert: Data breach via exposed internal archiving systemhttps://feed.craftedsignal.io/briefs/2026-11-digicert-data-breach/Fri, 06 Nov 2026 14:28:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-digicert-data-breach/Unauthorized actors exploited a publicly exposed internal customer archiving system with an insecure self-registration feature to access sensitive business customer contact information and identity documents.DigiCert disclosed a data breach involving an internal system used to archive customer information. In February 2025, the system was moved to a different network segment, resulting in inadvertent exposure to the internet. Between June 27 and July 2, 2026, unauthorized actors exploited a self-registration feature in the system's account manager, which lacked multi-factor authentication (MFA), to create read-only accounts. This access allowed the exfiltration of customer names, email addresses, phone numbers, business addresses, and in some instances, identity documents including driver's licenses and passports. DigiCert confirmed that the core Certificate Authority (CA) systems were isolated on secure network segments and remained unaffected. The breach was remediated by deactivating the self-registration feature, verifying account ownership, and resetting passwords for all system users.

Attack Chain

  1. Internal archiving system was migrated to a new network segment (February 2025).
  2. Migration error resulted in the internal system becoming exposed to the public internet.
  3. Attackers identified the exposed system and its self-registration account creation feature.
  4. Attackers created a read-only account using the self-registration feature, bypassing the need for MFA.
  5. Attackers utilized the unauthorized account to access and exfiltrate archived customer data (June 27 to July 2, 2026).
  6. DigiCert identified and blocked the unauthorized account (July 2, 2026).

Impact

Confirmed compromise of business customer contact information, including names, email addresses, phone numbers, and business addresses. Select customers also had sensitive identity documentation (driver's licenses, passports, utility bills) exposed.

Recommendation

  • Immediately audit all internal systems moved during network segment migrations to verify they are not inadvertently exposed to the internet.
  • Disable self-registration features on internal-only systems; if required, gate registration behind robust multi-factor authentication (MFA).
  • Implement monitoring for administrative or account-creation events on internal systems to detect unauthorized account provisioning.
  • Review and tighten network segmentation policies to ensure internal archiving and administrative tools are not reachable via external interfaces.
]]>highadvisorydata-breachidentity-theftmisconfiguration