Data Analysis
The Numbers Behind the Biggest Compliance Fraud
Report Type Breakdown
Distribution across 533 leaked reports
ISO 2700184
SOC 2 Type 1251
SOC 2 Type 2198
Infrastructure Distribution
Cloud providers used by affected companies
AWS110
GCP21
Supabase17
Azure15
Vercel12
Render11
Fly.io3
Heroku2
Key Findings
Patterns that prove these reports were mass-produced, not individually audited
1 Auditor, 487 Companies
The same auditor license number was rubber-stamped across 487 different company reports — as if one person audited them all at the same time
Identical Page Numbers
Every report has the exact same structure and page layout. Different companies should produce different-length reports — unless nobody actually wrote them individually
220+ "No Problems Found"
Every single security check came back clean — 220+ times per report, across every company. In the real world, every company has issues. Zero problems means zero actual checking
Find & Replace
Reports were generated from one template — only the company name was swapped in. The security conclusions were written before anyone even looked at the company
Is your vendor in the database?
Check if your vendor's SOC 2 or ISO 27001 report was produced by the same compliance mill.
Check if your vendor is in the database