Member of ‘The Com’ Cybercrime Collective Sentenced for Global Sextortion Campaign Targeting 117 Minors
What Happened — A 20‑year‑old member of the loosely‑organized “The Com” group was convicted in Leeds Crown Court and sentenced to two years in prison for blackmail and sextortion against 117 female victims aged 13‑17 worldwide. Investigators recovered private images, threatening messages, and evidence that the offender coerced victims into self‑harm and the creation of child sexual‑abuse material.
Why It Matters for Compliance & Audit Readiness
- The case illustrates how social‑engineering attacks can harvest personal data and leverage it for extortion – a scenario SOC 2 access‑control and security‑awareness requirements are designed to prevent and document.
- Continuous evidence of employee and user training, plus monitoring of communication channels, satisfies the SOC 2 CC6.1 (Security Awareness) and CC6.2 (User Access Management) controls.
- Demonstrating a defensible audit trail of awareness‑program effectiveness helps organizations prove due diligence when faced with investigations or regulator inquiries.
Who Is Affected – Education & youth‑service providers, social‑media platforms, SaaS applications that host under‑18 users, and any organization that processes minors’ personal data.
Recommended Actions
- Map the incident to SOC 2 CC6.1 (Security Awareness) and CC6.2 (User Access Management) controls; verify that training records and phishing‑simulation results are collected as audit evidence.
- Deploy continuous monitoring of communication platforms for grooming‑related language using DLP or UEBA tools, and retain logs for forensic review.
- Review and tighten policies around the collection, storage, and sharing of minors’ personally identifiable information (PII).
Source: BleepingComputer
Technical Notes – The perpetrators used Snapchat, Telegram, and Discord to gain trust, harvest private images, and issue threats. No software vulnerability was disclosed; the attack vector was social‑engineering (phishing‑style grooming). Source: same as above