Inter-Con Security Breach Exposes 276,000 Email Addresses and Personal Data
What Happened — In June 2026, the ShinyHunters extortion group claimed to have stolen data from Inter‑Con Security and published a dump of 276 k unique records. The leak includes email addresses, names, job titles, phone numbers and physical addresses for internal users, contacts and leads.
Why It Matters for Compliance & Audit Readiness
- The incident illustrates a failure to protect personal data under SOC 2 CC6 (Confidentiality) and CC5 (Privacy) – controls that require documented access‑restriction, monitoring and incident‑response processes.
- Continuous evidence of how personal data is collected, stored, and protected (e.g., consent logs, DSAR handling) is essential to demonstrate audit‑ready privacy posture.
Who Is Affected – Security‑services firms, managed‑service providers, and any organization that stores employee or client contact data.
Recommended Actions –
- Map the exposed data fields to SOC 2 privacy controls and verify that consent, retention, and access‑restriction policies are in place.
- Collect and preserve logs (access, export, admin actions) as audit evidence of the breach timeline and response.
- Update incident‑response playbooks to include data‑exposure notification procedures and DSAR readiness checks.
Source: Have I Been Pwned – Inter‑Con Security
Technical Notes – The breach was driven by a “pay‑or‑leak” extortion campaign; no specific vulnerability was disclosed. The data set comprises personal identifiers (email, name, address, phone) and job‑related information. Source: HIBP Breach Detail