A 1 October ransomware attack hit an institution's virtualization infrastructure and every server running on it, according to Türkiye's data protection authority. Up to 145,000 people may be affected.
On 1 October 2026, the IT infrastructure of Yıldız Technical University in Istanbul was hit by ransomware. According to the public notice published by Türkiye's Personal Data Protection Board (KVKK) under decision 2026/2203 of 7 October 2026, the attack affected the institution's virtualization infrastructure and the servers running on top of it. Based on current records, the notice states that roughly 140,000 students and 4,500 staff may have been affected. The categories of data involved and the number of affected visitors have not yet been established, and the investigation is ongoing.
In a statement to Euronews Türkçe, the university said no outbound data transfer was detected, that around 500 TB of data was scanned and returned to the live environment, and that 95 percent of systems were back in service. The breach was reported to KVKK on 6 October, partial access was restored on 5 October, and recovery took roughly nine days.
What makes this case different: the target was the layer beneath the servers
The detail that matters here is that the attack did not hit individual servers but the virtualization layer underneath them. If ten, twenty or fifty servers in an office run on the same virtualization platform, compromising that layer means every one of those servers stops at the same moment. When the domain controller, file server, accounting database and mail system all live on the same hardware, a single administrator account can halt the entire business.
The second detail is recovery time. The university did get its data back, yet the cleanup still took days. Having a backup and being operational the same day are not the same thing.
What this means for businesses in Türkiye
On that same day, 7 October 2026, KVKK published twelve separate data breach notices. The list includes construction, textile, healthcare investment, retail and software companies. This is not a large-enterprise problem; the notification duty makes no distinction by company size.
Another notice from the same batch (decision 2026/2198) points to a different exposure: the unauthorized access did not happen in the company's own systems but in the systems of the supplier processing its data. Identity, contact, location, customer transaction and financial information were affected. Outsourcing the service does not outsource the reporting obligation. Under Turkish law, the data controller must notify the Board as soon as possible and in any case within 72 hours of becoming aware of a breach.
What Kamer Bilişim recommends
- Move backups outside the virtualization environment and test the restore. If your backup sits on storage reachable from the same platform or the same administrator account, it is lost alongside everything else. Keep an immutable or air-gapped copy, and run a real restore test at least once a quarter. The number worth measuring is not whether a backup exists, but how many hours it takes you to come back.
- Separate virtualization and management consoles from the user network. Hypervisor interfaces, backup consoles and server management cards should not be reachable from the network staff use day to day. Access them only through a dedicated management network with multi-factor authentication, and keep administrator accounts separate from the ones used for everyday work.
- Document supplier access and your breach notification process. Record which external service touches which system, with what privileges and for how long. Who runs the 72-hour notification, and with what information, should be decided before an incident, not during one.
If you want to measure how long a restore of your virtual infrastructure actually takes, separate your management consoles at the network level, or review your breach notification process, you can reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: KVKK public notices (7 October 2026, Board decisions 2026/2203 and 2026/2198); Euronews Türkçe, 10 October 2026.