Does SOC 2 or ISO 27001 Prevent Breaches? 2026 Data
TL;DR · the short version
We looked at 35 well-known companies with a breach or cyber incident disclosed or claimed in 2026 (29 confirmed by the company or a filing, 6 claimed by attackers or researchers) and checked which security certifications each publicly held. 15 publicly held SOC 2 or ISO 27001 for at least part of their business; 20 had no public certification we could find. Of the 15, the published certificate scope plainly covered the system that was breached in 2 cases (Instructure’s Canvas and KDDI’s company-wide ISMS), covered a different part of the business in 4 (Medtronic, iRhythm, Coinbase, PwC), and could not be matched from public information in 9. Certification is evidence that a security program is run and independently checked for a stated scope; it is not a promise that nobody will be phished or that a supplier’s platform is safe, and many 2026 incidents began exactly those ways. The full sourced dataset, with revenue, share-price reactions and a CSV download, is in the PlayCISO Breach Index.
Does security certification prevent breaches? Not on its own. Of 35 well-known companies with a breach or cyber incident disclosed or claimed in 2026, 15 publicly held SOC 2 or ISO 27001 for at least part of their business, and 20 had no public certification we could find. In only 2 of the 15 did the published certificate scope plainly cover the system that was breached.
Who this is for: security leaders, procurement and third-party-risk teams, and anyone who has been told “they’re SOC 2 certified” as the answer to a security question.
Independent research based on company filings and statements, certificate registries, company trust pages and reputable reporting. PlayCISO is not affiliated with any company named. Facts as reviewed on 31 October 2026. The full dataset, with a source for every field, is in the Breach Index.
The numbers, from the dataset
35 companies with a 2026 incident: 29 confirmed by the company, a filing or a regulator; 6 claimed by attackers or researchers and not confirmed.
15 publicly held SOC 2 or ISO 27001 for some scope (7 SOC 2, 11 ISO 27001; some both). 12 of those had a confirmed incident.
Of the 15: scope plainly covered the breached system in 2; covered a different part of the business in 4; unclear from public information in 9.
20 had no public certification we could find. That is a statement about what is public, not proof they had none.
Why this question keeps coming up
People point to companies like Binance, which announced a SOC 2 Type II audit of its global platform in December 2023 and has held ISO/IEC 27001 since 2019, and ask what the badges are worth. (We found no 2026 breach confirmed by Binance or a regulator, so it is not in our list.) The fair way to answer is with data: take the companies that were actually breached this year, and check what they had publicly claimed about their security.
Certified and breached: the cases where scope is clear
| Company | Certificate and stated scope | What was breached (2026) | Scope covered it? |
|---|---|---|---|
| Instructure | ISO 27001, SOC 2 Type II and PCI DSS renewed Dec 2025, naming Canvas in scope | Canvas: names, emails, student IDs and messages (company-confirmed, May) | Yes |
| KDDI | ISO 27001 ISMS, company-wide since 2009 | ISP email platform via a third-party software zero-day; 12.2M email addresses, 7.6M passwords (KDDI) | Yes |
| Medtronic | ISO 27001 for the CareLink network | Corporate IT systems, 13–19 April; 3,834,294 people (Indiana AG filing) | No |
| iRhythm | SOC 2 Type II for the Zio service | Third-party-hosted business applications, via social engineering (8-K, June) | No |
| Coinbase | SOC 2 Type 2 for Custody and Prime; Type 1 for staking | A contractor misused support tools to view about 30 customers’ data (Feb) | No |
| PwC | ISO 27001 per member firm (e.g. PwC UK: client confidential data) | A third-party vendor hosting employee learning records (Oct) | No |
The other nine certified companies, including OpenAI, Grafana Labs and Hugging Face, publish certificates whose scope does not tell you whether the breached system (an employee laptop, a GitHub environment, a production pipeline) was inside it.
What the certificates attest to, and what they don’t
- SOC 2 Type II is an auditor’s opinion that the controls in the company’s own system description were designed and operated effectively over a period, against criteria it chose. It covers the described system only. It is an attestation, not a certification.
- ISO/IEC 27001 certifies a management system for a stated scope: risks assessed, controls chosen and justified, the system monitored and improved. Three-year certificates, annual surveillance audits.
- Neither tests whether every employee resists a convincing voice-phishing call, whether a supplier’s platform is secure, or whether software you depend on has a zero-day. In our dataset, many confirmed incidents began one of those ways by the companies’ own accounts: social engineering of an employee or contractor (Carnival, iRhythm, Apollo, Bumble), a supplier’s platform (PwC, EY) or third-party software (KDDI, Michelin, OpenAI).
That is not an argument that certification is useless. It is evidence that a program exists, is documented and gets checked, which is more than many companies can show. It is an argument for reading the scope.
What security leaders should do this week
- Ask for scope, not the badge. Request the SOC 2 system description and exceptions, or the ISO 27001 certificate scope and statement of applicability, and check the exact service you buy is in it. The Vendor Risk Scorecard covers the follow-up questions.
- Ask the questions audits don’t. How does the vendor stop a phoned-in MFA reset? How are bulk exports from its CRM and support tools monitored? Which of its own suppliers hold your data?
- Prepare the breach call. When a certified vendor is breached, your first questions decide how fast you can act. Use the Third-Party Breach Intake.
- Price what you still carry. A vendor’s certificate does not move liability off your books. Model it with the breach-cost estimator.
Method, briefly
Companies: well-known names with an incident first disclosed or claimed between 1 January and 31 October 2026. Certifications: only those sourced to the company’s own trust or compliance page, a filing, a certificate registry (BSI, CSA STAR) or a government procurement listing; third-party badge sites were not counted. Revenue is the latest fiscal year before the incident, in reporting currency. Share-price moves are shown only where a named outlet reported one (for example, Bloomberg reported Stryker fell 3.6% on the day of its disclosure). Full methodology and limitations are on the Breach Index.
FAQ
Does SOC 2 or ISO 27001 certification prevent data breaches?
No certification promises that. In our 2026 dataset, 15 of 35 breached companies publicly held SOC 2 or ISO 27001 for some scope. A certificate shows an auditor checked defined controls for a stated scope and period; it does not test every employee, supplier or piece of third-party software.
How many companies breached in 2026 had SOC 2 or ISO 27001?
15 of 35: 7 with SOC 2 and 11 with ISO 27001, some with both. 12 of the 15 had a confirmed incident; the other 3 are unconfirmed claims.
Did the certificate cover the system that was breached?
Plainly yes in 2 of the 15 (Instructure, KDDI), no in 4 (Medtronic, iRhythm, Coinbase, PwC), and unclear from public information in 9.
Was Binance breached in 2026?
We found no 2026 breach confirmed by Binance or a regulator. It is often cited in this debate because of its SOC 2 Type II audit (announced December 2023) and ISO/IEC 27001 certification (since 2019).
Should I still ask vendors for SOC 2 or ISO 27001?
Yes, but read the scope and exceptions, and ask the questions certificates do not answer: help-desk and MFA reset controls, monitoring of SaaS data exports, and which of their suppliers hold your data.
Sources
- PlayCISO Breach Index: breaches, certifications and security posture (dataset, every row sourced; CSV download)
- Instructure: renewal of ISO 27001, SOC 2 Type II and PCI DSS (Dec 2025) and BleepingComputer: Instructure confirms data breach
- KDDI security portal (ISMS certification) and BleepingComputer: KDDI breach affects 12 million
- Medtronic: CareLink network (ISO 27001) and SecurityWeek: Medtronic breach impacts 3.8 million
- iRhythm Trust Center (SOC 2 Type II) and BankInfoSecurity: iRhythm tells SEC
- Coinbase: SOC reports and SC Media: Coinbase confirms insider breach affecting 30 customers
- PwC UK ISO 27001 certificate and Reuters: PwC confirms incident involving employee learning records
- The Fintech Times: Binance completes SOC 2 Type II audit and Crowdfund Insider: Binance awarded ISO 27001
- Bloomberg via Insurance Journal: Stryker shares fall 3.6%
This article is general information, not legal, audit or investment advice.
Ready to practise the decisions these articles describe?
Run your first War Room free →One run free with a free account · more runs with Pro