International Code Council Data Breach

The International Code Council, Inc. (“ICC”), the nonprofit organization behind the widely used International Building Code and other model construction codes, has notified individuals of a data security incident that impacted their personal information. Organizations that process online payments have a responsibility to secure the payment card data their customers provide, and when that security is compromised, affected individuals deserve a clear explanation of what happened.

International Code Council’s Data Breach Investigation

According to a notification letter ICC filed with state regulators, the organization recently discovered a security incident impacting its website that made it possible for an unauthorized third party to collect payment card information entered by customers when placing a purchase on the website between June 30, 2026, and July 3, 2026. ICC states it is providing information about steps individuals can take to protect their personal information and is offering 12 months of complimentary identity protection services through IDX at no charge to affected individuals.

Website-based payment card skimming incidents, sometimes referred to as e-skimming or Magecart-style attacks, involve malicious code injected into a website’s checkout process that captures payment card details as customers enter them, often without any visible sign to the customer that anything is wrong. These attacks are common against organizations of all sizes that process online payments, including nonprofit and membership-based organizations like ICC that sell codes, publications, and training materials through their websites.

Because payment card data captured through a skimming-style attack is typically exfiltrated in near real time as customers enter it, the specific window of exposure — in this case, a few days at the end of June and beginning of July 2026 — is an important detail for affected individuals to know when reviewing their own card statements from that period for unauthorized charges. ICC’s relatively prompt public notification, coming about six to seven weeks after the incident, allows affected customers meaningful time to review their financial records for the specific period identified.

Organizations that discover this type of vulnerability typically work to close the security gap immediately upon discovery and then notify affected customers so they can take protective action with their card issuers. Even when a company acts quickly to secure its systems, affected individuals whose payment card information was captured during the exposure window can still face a real risk of fraudulent charges, and understanding the available legal options is an important part of responding to a breach like this one.

When Did This Breach Occur?

ICC’s notice states that the unauthorized collection of payment card information occurred between June 30, 2026, and July 3, 2026, affecting customers who made purchases on the organization’s website during that window. The security incident was discovered afterward, with notification letters going out to affected individuals in August 2026.

What Information Was Breached?

ICC’s notice confirms that payment card information entered during checkout on the organization’s website between June 30 and July 3, 2026 was collected by an unauthorized third party. Affected individuals should review their notification letter and their payment card statements from that period closely for any unauthorized charges.

What You Can Do

If you received a notice from the International Code Council, consider taking these steps to protect yourself:

• Enroll in the complimentary 12-month IDX identity protection services using the enrollment code and instructions provided in your letter before the stated deadline.
• Review your payment card statements from late June through early July 2026 for any charges you don’t recognize, and report them to your card issuer immediately.
• Consider requesting a replacement card number from your bank or card issuer if you used your card on ICC’s website during the affected window.
• Place a fraud alert with one of the three major credit bureaus so creditors must verify your identity before extending new credit.
• Monitor your credit reports and financial accounts regularly for signs of unauthorized activity.

File a Data Breach Lawsuit Against International Code Council

If you received a data breach notification letter from the International Code Council, you may be entitled to compensation for the exposure of your payment card information. Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.