Turkey's KVKK published ten data breach notifications on 21 October. At three well-known brands the source was identical: a third-party software library flaw on a supplier's server.
Turkey's Personal Data Protection Authority (KVKK) published ten separate data breach notifications on its website on the same day, 21 October 2026. The list includes a metropolitan municipality, a state university, a private healthcare provider, a foundation and several well-known food brands. Read together, the notices share a striking common thread: the intrusion did not start on the companies' own networks, but in third-party software they relied on.
One flaw, three brands
According to the published notices, Güllüoğlu Gıda, Kurukahveci Mehmet Efendi and Dermojet each went through an identical scenario: unauthorised access was obtained by exploiting a security vulnerability in a third-party software library running on the server of the data processor serving them.
The Güllüoğlu notice states the breach was identified on 8 October 2026 following the processor's warning, and that 67,193 people were affected; exposed data included names, phone numbers, e-mail and postal addresses, stored password values and seller panel accounts. The Mehmet Efendi notice records detection on 7 October 2026, affecting 15,303 customers and 18 management panel accounts. Both were published under Board decision no. 2026/2281 of 21 October 2026.
What else the notices show
- Ransomware at two organisations: A ransom note was found on a private healthcare provider's server and its database became inaccessible; the encrypted server held identity, contact, examination, diagnosis and prescription records. At a foundation, affected data included passport copies. In both cases the number of affected individuals has yet to be determined.
- Account takeover with a leaked password: At a metropolitan municipality, two corporate mailboxes were accessed using a previously compromised password. The attackers exported mailbox contents, created a rule deleting incoming mail and added fraudulent text to an e-mail signature. The incident was detected on 30 September 2026.
- Social engineering over the phone: At two organisations, employee accounts were taken over through voice phishing and social engineering. In one case access began on 4 August but went unnoticed until 6 October.
Why this matters for SMEs
The lesson for small and mid-sized businesses is direct: even where your own server is fully patched, a flaw on the server of the supplier running your e-commerce platform, accounting software or CRM becomes your breach notification. Under Law no. 6698 accountability sits with the data controller — if customer data leaks from a processor's infrastructure, you are still the one who reports to the Board and answers for it.
The second point is detection time. In these cases the breach was usually spotted not by the company's own monitoring but through a warning from the processor or from USOM, Turkey's national cyber incident response centre; in one incident two months passed first. The third is passwords: several notices list "stored password values" among the affected data.
What we recommend at Kamer Bilişim
- Inventory your suppliers and put it in the contract. List which company's servers hold which of your customer data. Add to processor agreements a notification deadline in the event of a breach, a patching and update commitment, and an obligation to keep the components in use current.
- Build the monitoring that shortens detection. Collect server, firewall and mail system logs centrally, and define alerts for unusual sign-ins, bulk exports and newly created mailbox rules. Learning about a breach from your supplier is the most expensive scenario there is.
- Make MFA mandatory on management panels and e-mail. In at least three of the incidents above the entry point was a compromised password. Enable multi-factor authentication on panel and corporate mail access, close the accounts of departing staff, and put your 72-hour KVKK notification procedure in writing.
If you would like support with your supplier inventory, log monitoring setup or KVKK breach procedure, reach us through our contact page.
Source: Personal Data Protection Authority public breach notices (21.10.2026, Board decision 2026/2281); Memurlar.net.