One Server Move Left the Door Open
Picture this. You move your office to a new space. The movers are careful, the boxes arrive, and the new place looks great. Then, a year and a half later, you find out the back door never had a lock. Nobody broke in on day one. But nobody checked, either.
That is close to what just happened to DigiCert, one of the biggest names in website security. And the lesson fits any business with a computer, a website, or a cloud account.
What happened
DigiCert sells the digital certificates that put the little padlock next to your web address. In February 2025, the company moved one of its internal business systems out of a protected, private network. The move was handled as a routine IT change, not a security change, so nobody looked closely at who could now reach it. Per The Record, that system sat reachable from the internet until July 2, 2026, and an unauthorized person got in starting June 27.
What was inside? Customer names, business emails, phone numbers, and for some customers, scanned driver’s licenses, passports, and utility bills. DigiCert says it has seen no sign the data was misused, and its core certificate services were not touched. Still, that is about 17 months of an open door.
The same week, the same kind of mistake
This was not a one-off. A weekly breach roundup from Privacy Guides also listed Applebee’s, where a researcher found a database password written right into the company’s mobile app. Anyone who looked could get to customer records. Different company, same root cause: a setting or a shortcut that nobody double-checked.
Why this matters to a small business
You probably do not have a certificate company. But you do have changes. A new office router. A website moved to a new host. A shared folder in the cloud. A new phone system. A file server your last IT person set up. Every one of those is a moment where something can quietly end up open to the world.
Most breaches are not movie hacking
People picture hooded hackers cracking codes. Far more often, it is a door left unlocked and a stranger who tried the handle. That is good news, because unlocked doors are something you can check for.
Old data is still your data
DigiCert’s exposed files were archived records. Old customer scans, old invoices, old employee paperwork sitting in a forgotten system are just as valuable to a thief as today’s data. If you do not need it, the safest copy is the one that no longer exists.
Want the bigger picture on what we look at for businesses your size? Our small business cyber security solutions page walks through it, and our blog has plenty more plain-English reads.
What you can do this week
- Make a short list of what you changed in the last 12 months. New hosting, new software, new office, new Wi-Fi, new cloud folders. If it changed, it needs a second look.
- Ask your IT provider one question in writing: “After our last change, did anyone check what is reachable from the internet?” A good provider answers in a day.
- Look for accounts nobody can explain. DigiCert later found an account that no one had been assigned to. Check your email, cloud, and website admin lists for names you do not recognize.
- Check your cloud folders. Make sure shared links and storage are set to “people I choose,” not “anyone with the link.”
- Delete what you do not need. Old scans of IDs, old customer files, and old exports should not live forever. Keep what the law or your insurer requires, and remove the rest.
- Keep devices and email protected. Good endpoint protection and spam and virus filtering catch the problems that slip past a mistake like this one.
- Test your backups. If something does go wrong, secure data backups are how you get back to work quickly. And teach your team to flag oddities with cybersecurity awareness training.
If you also run smart devices like thermostats or coolers, our recent post on hacked freezers and connected devices covers the same “forgotten side door” idea from another angle.
The bottom line
DigiCert has security teams most of us can only dream of, and a routine move still slipped through. The fix is not fear. It is a habit: whenever something changes, ask who can reach it now. That one question would have caught this in a day, not 17 months.
Not sure what changed on your network lately?
We will take a friendly look at your setup and tell you what is exposed, in plain English. Book a complimentary visit.
Send us a message
— Nemuel Cruz, Incognito Cyber Security
