The Asyaport Liman breach published by Turkey's KVKK on 27 October began with a flaw in a supplier's service desk application. October's notices show the same pattern: risk increasingly enters through the supply chain.
Turkey's Personal Data Protection Authority (KVKK) published a data breach notice for Asyaport Liman A.Ş. on 27 October 2026. The breach did not start in the company's own systems: it began with a security flaw in a supplier's "Service Desk" application. Attackers bypassed identity verification, changed the passwords on several accounts and gained unauthorised access.
What happened
According to the notice, published under Board decision 2026/2363 dated 27.10.2026, the breach began on 12 October 2026 and was detected on 19 October 2026. An initial assessment puts the number of affected people at 855, covering employees, users and customers. The exposed data consists of names, email addresses and phone numbers. The investigation is ongoing.
This is not an isolated case. On 7 October 2026 the KVKK published 17 new breach notices at once, based on Board decisions dated 07.10.2026. According to a review by CyberArts Pro dated 14 October 2026, data had been encrypted by attackers in 12 of them, and a significant share reached the controller through a data processor or third-party infrastructure. A notice published on 21 October 2026 describes a ransomware attack on the server infrastructure of the Enka Sports, Education and Social Aid Foundation.
Why it matters
The main lesson of the Asyaport case is this: even when the breach happens inside a supplier's system, the duty to notify the Authority and the affected individuals rests with the data controller. Under Board decision 2019/10 dated 24.01.2019, notification must be made within 72 hours of the controller becoming aware of the breach. A supplier telling you late does not extend that clock.
The second lesson concerns detection time. Seven days passed between the start of the Asyaport breach and its discovery. Throughout that window the attacker is free inside the environment, and the 72-hour clock only begins once someone notices. An organisation without detection capability accumulates risk and non-compliance at the same time.
What this means for SMEs in Turkey
Most small and mid-sized companies in Turkey now work with a long list of outside suppliers: accounting software, ERP vendors, call centre and service desk applications, shipping and customs integrations, payroll firms, cloud backup providers. Every one of them opens a door into your data.
Port operator, logistics firm, shipping agency, construction office or production plant — it makes no difference. Your real attack surface does not stop at your own server room; your suppliers' security posture is part of your own. And after a breach, it is the party that bought the service who answers to the KVKK.
What Kamer Bilişim recommends
- Build an inventory of suppliers and data processors. Which firm reaches which data, through which system, with what level of privilege? Do you have the written data processor agreement the law requires with each of them? Add an obligation to notify you without delay in the event of a breach — your 72-hour window depends on their speed.
- Narrow supplier access and log it. External firms should connect with named, time-limited accounts rather than shared ones, multi-factor authentication should be mandatory, and privileges should be scoped to the one system actually needed. Collect logs from remote access and admin panels centrally — that is precisely what closes the seven-day gap seen in the Asyaport case.
- Write your breach response plan now, and rehearse it once. Who assesses the incident, who files the notification, who completes the form, how are affected individuals contacted? These questions need answers today, not on the day of the breach. A single tabletop exercise exposes most of the gaps.
If you would like to review your supplier access, log collection and breach response process together, you can reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: KVKK public breach notices (27.10.2026 / 2026-2363 and 21.10.2026 / 2026-2284), CyberArts Pro (14 October 2026), Board decision 24.01.2019 / 2019-10
Source: KVKK Kamuoyu Duyurusu