DigiCert Security Lapse: 16-Month Customer Data Exposure Disclosed

What happened

DigiCert has acknowledged that a security lapse exposed customer information over a 16-month period, according to reporting by The Register. The lapse began with a botched server move that left an access point open, and the company took months to realise that an unauthorised party had got in.

The disclosure is significant because the exposure lasted well over a year before it was acknowledged publicly. The reporting frames the core failure as one of both configuration and detection: the change itself went wrong, and the monitoring did not flag the resulting access quickly enough.

Why it matters

For leaders in digital transformation, the case is a reminder that infrastructure modernisation carries operational risk of its own. A server migration is usually planned as a technical task, but here it created an exposure that persisted long enough to affect customer data. Detection and post-change verification matter as much as the migration plan itself.

For customers, the experience of a data incident is shaped by how quickly and clearly they are told what happened. A window of more than a year before the issue surfaced publicly places a heavy burden on trust, and affected customers depend on plain, timely information about what was exposed and what they should do next.

By the numbers

• 16 months the period over which customer information was reportedly exposed before the lapse was acknowledged.
• 6 November 2026 the date of The Register's report on the disclosure.

The Renascence take

Most attention on incidents like this goes to the breach itself. The more instructive question for operators is how a single configuration change could remain undetected for more than a year.

Most readers will focus on the breach, but the real lesson sits in the monitoring gap that let a migration error run for 16 months. Infrastructure changes are treated as one-off events, yet their risks are long-tailed, so they deserve the same post-launch scrutiny that customer journeys receive. A customer-obsessed operator should treat every migration as a service change, with named owners, post-go-live verification and alerts on access nobody expected. Trust is rebuilt faster by a candid timeline than by reassurance.