# Does SOC 2 or ISO 27001 Prevent Breaches? 2026 Data

> 15 of 35 companies breached in 2026 publicly held SOC 2 or ISO 27001. What the certificates covered, what they did not, and what to ask vendors.

Source: https://playciso.com/blog/certified-and-breached-2026-soc2-iso27001 · Published: 2026-10-31 · Publisher: PlayCISO (https://playciso.com)

---

**Does security certification prevent breaches?** Not on its own. Of **35 well-known companies** with a breach or cyber incident disclosed or claimed in 2026, **15 publicly held SOC 2 or ISO 27001** for at least part of their business, and 20 had no public certification we could find. In only 2 of the 15 did the published certificate scope plainly cover the system that was breached. **Who this is for:** security leaders, procurement and third-party-risk teams, and anyone who has been told “they’re SOC 2 certified” as the answer to a security question. _Independent research based on company filings and statements, certificate registries, company trust pages and reputable reporting. PlayCISO is not affiliated with any company named. Facts as reviewed on 31 October 2026. The full dataset, with a source for every field, is in the [Breach Index](/breach-index)._ The numbers, from the dataset **35** companies with a 2026 incident: **29 confirmed** by the company, a filing or a regulator; **6 claimed** by attackers or researchers and not confirmed. **15** publicly held SOC 2 or ISO 27001 for some scope (7 SOC 2, 11 ISO 27001; some both). **12** of those had a confirmed incident. Of the 15: scope plainly covered the breached system in **2**; covered a different part of the business in **4**; unclear from public information in **9**. **20** had no public certification we could find. That is a statement about what is public, not proof they had none. ## Why this question keeps coming up People point to companies like Binance, which announced a SOC 2 Type II audit of its global platform in December 2023 and has held ISO/IEC 27001 since 2019, and ask what the badges are worth. (We found no 2026 breach confirmed by Binance or a regulator, so it is not in our list.) The fair way to answer is with data: take the companies that were actually breached this year, and check what they had publicly claimed about their security. ## Certified and breached: the cases where scope is clear CompanyCertificate and stated scopeWhat was breached (2026)Scope covered it? [Instructure](/breach-index/instructure)ISO 27001, SOC 2 Type II and PCI DSS renewed Dec 2025, naming Canvas in scopeCanvas: names, emails, student IDs and messages (company-confirmed, May)Yes [KDDI](/breach-index/kddi)ISO 27001 ISMS, company-wide since 2009ISP email platform via a third-party software zero-day; 12.2M email addresses, 7.6M passwords (KDDI)Yes [Medtronic](/breach-index/medtronic)ISO 27001 for the CareLink networkCorporate IT systems, 13–19 April; 3,834,294 people (Indiana AG filing)No [iRhythm](/breach-index/irhythm)SOC 2 Type II for the Zio serviceThird-party-hosted business applications, via social engineering (8-K, June)No [Coinbase](/breach-index/coinbase)SOC 2 Type 2 for Custody and Prime; Type 1 for stakingA contractor misused support tools to view about 30 customers’ data (Feb)No [PwC](/breach-index/pwc)ISO 27001 per member firm (e.g. PwC UK: client confidential data)A third-party vendor hosting employee learning records (Oct)No The other nine certified companies, including [OpenAI](/breach-index/openai), [Grafana Labs](/breach-index/grafana-labs) and [Hugging Face](/breach-index/hugging-face), publish certificates whose scope does not tell you whether the breached system (an employee laptop, a GitHub environment, a production pipeline) was inside it. ## What the certificates attest to, and what they don’t - SOC 2 Type II is an auditor’s opinion that the controls in the company’s own system description were designed and operated effectively over a period, against criteria it chose. It covers the described system only. It is an attestation, not a certification. - ISO/IEC 27001 certifies a management system for a stated scope: risks assessed, controls chosen and justified, the system monitored and improved. Three-year certificates, annual surveillance audits. - Neither tests whether every employee resists a convincing voice-phishing call, whether a supplier’s platform is secure, or whether software you depend on has a zero-day. In our dataset, many confirmed incidents began one of those ways by the companies’ own accounts: social engineering of an employee or contractor (Carnival, iRhythm, Apollo, Bumble), a supplier’s platform (PwC, EY) or third-party software (KDDI, Michelin, OpenAI). That is not an argument that certification is useless. It is evidence that a program exists, is documented and gets checked, which is more than many companies can show. It is an argument for reading the scope. ## What security leaders should do this week - Ask for scope, not the badge. Request the SOC 2 system description and exceptions, or the ISO 27001 certificate scope and statement of applicability, and check the exact service you buy is in it. The Vendor Risk Scorecard covers the follow-up questions. - Ask the questions audits don’t. How does the vendor stop a phoned-in MFA reset? How are bulk exports from its CRM and support tools monitored? Which of its own suppliers hold your data? - Prepare the breach call. When a certified vendor is breached, your first questions decide how fast you can act. Use the Third-Party Breach Intake. - Price what you still carry. A vendor’s certificate does not move liability off your books. Model it with the breach-cost estimator. ## Method, briefly Companies: well-known names with an incident first disclosed or claimed between 1 January and 31 October 2026. Certifications: only those sourced to the company’s own trust or compliance page, a filing, a certificate registry (BSI, CSA STAR) or a government procurement listing; third-party badge sites were not counted. Revenue is the latest fiscal year before the incident, in reporting currency. Share-price moves are shown only where a named outlet reported one (for example, Bloomberg reported Stryker fell 3.6% on the day of its disclosure). Full methodology and limitations are on the [Breach Index](/breach-index). ## FAQ ### Does SOC 2 or ISO 27001 certification prevent data breaches? No certification promises that. In our 2026 dataset, 15 of 35 breached companies publicly held SOC 2 or ISO 27001 for some scope. A certificate shows an auditor checked defined controls for a stated scope and period; it does not test every employee, supplier or piece of third-party software. ### How many companies breached in 2026 had SOC 2 or ISO 27001? 15 of 35: 7 with SOC 2 and 11 with ISO 27001, some with both. 12 of the 15 had a confirmed incident; the other 3 are unconfirmed claims. ### Did the certificate cover the system that was breached? Plainly yes in 2 of the 15 (Instructure, KDDI), no in 4 (Medtronic, iRhythm, Coinbase, PwC), and unclear from public information in 9. ### Was Binance breached in 2026? We found no 2026 breach confirmed by Binance or a regulator. It is often cited in this debate because of its SOC 2 Type II audit (announced December 2023) and ISO/IEC 27001 certification (since 2019). ### Should I still ask vendors for SOC 2 or ISO 27001? Yes, but read the scope and exceptions, and ask the questions certificates do not answer: help-desk and MFA reset controls, monitoring of SaaS data exports, and which of their suppliers hold your data. ## Sources - PlayCISO Breach Index: breaches, certifications and security posture (dataset, every row sourced; CSV download) - Instructure: renewal of ISO 27001, SOC 2 Type II and PCI DSS (Dec 2025) and BleepingComputer: Instructure confirms data breach - KDDI security portal (ISMS certification) and BleepingComputer: KDDI breach affects 12 million - Medtronic: CareLink network (ISO 27001) and SecurityWeek: Medtronic breach impacts 3.8 million - iRhythm Trust Center (SOC 2 Type II) and BankInfoSecurity: iRhythm tells SEC - Coinbase: SOC reports and SC Media: Coinbase confirms insider breach affecting 30 customers - PwC UK ISO 27001 certificate and Reuters: PwC confirms incident involving employee learning records - The Fintech Times: Binance completes SOC 2 Type II audit and Crowdfund Insider: Binance awarded ISO 27001 - Bloomberg via Insurance Journal: Stryker shares fall 3.6% _This article is general information, not legal, audit or investment advice._