KVKK released ten data breach notifications at once on 21 October. In three of them the flaw sat in a supplier's software, not in the reporting organisation's own servers.
Turkey's Personal Data Protection Authority (KVKK) published ten separate data breach notifications in a single batch on 21 October 2026. The organisations involved have almost nothing in common with one another: food manufacturers, a state university, a metropolitan municipality, two healthcare providers, a hotel operator and an international hotel chain. Across the five notifications where a figure was disclosed, 142,791 people were affected. The remaining five have not yet established how many records were exposed.
In three of the ten cases, the weak point belonged to a supplier
The detail that matters most for business owners is where the attacks actually started. In three of the notifications, intruders did not break into the organisation's own servers at all. They exploited a vulnerability in third-party software running on systems operated by a data processor acting on the organisation's behalf. Güllüoğlu Gıda reported 67,193 affected individuals, Dermojet 50,636, and Kurukahveci Mehmet Efendi up to 15,303. In each case the exposed data included names, phone numbers, email addresses and postal addresses, alongside stored password data and administrative panel accounts.
The other notifications follow familiar patterns: two ransomware incidents, one compromised corporate email password that was used to export mailboxes and send spam, and two cases that began with social engineering aimed at an employee — including a voice phishing campaign that ran from early August to early October before it was caught.
Why this lands differently for a small business
Article 12 of Law No. 6698 requires the data controller to take administrative and technical measures to prevent unlawful processing of and access to personal data. The obligation does not transfer when work is outsourced. If another company runs your e-commerce platform, your accounting software, your CRM or your dealer portal, the customer data inside it is still yours in the eyes of the law, and reporting a breach to KVKK is still your duty, not your vendor's.
Timing is the second pressure point. KVKK expects notification without undue delay and within 72 hours of the controller becoming aware of a breach. In several of these cases, weeks passed between the date the incident was detected and the date it was reported. That gap is exactly why it matters to be able to prove when you first learned of a problem — and an organisation with no logging has no way to answer that question.
Finally, note that the notifications distinguish between "stored password data" and hashed passwords. That distinction decides how much damage reaches your customers after the fact, and it is a question worth asking any supplier that holds credentials for you.
What Kamer Bilişim recommends
- Build a supplier inventory and put it in writing. Which company processes which personal data on your behalf, where does it sit, and how quickly will they tell you if something goes wrong? Data processing agreements should name a notification window, log sharing and specific security measures rather than general assurances.
- Require multi-factor authentication and access logging on every internet-facing panel. Admin panel accounts and corporate email passwords were direct targets in these incidents. A password alone is not a defence for anything exposed to the internet. On the email side, monitor sign-in records and mailbox rule changes.
- Write the 72-hour response plan before you need it. Who notices the incident, who gets called, which logs are collected, and who prepares the KVKK notification? Put it on one page and rehearse it once a year. Searching for a phone number while an incident is live is the most expensive delay there is.
We work with SMEs, offices, logistics and maritime agencies, clinics and production facilities across the Anatolian side of Istanbul, and remotely, on supplier inventories, hardening panel access, setting up logging infrastructure and running KVKK compliance work. To review where you currently stand, reach us through our contact page.
Source: KVKK public announcements (21 October 2026), Memurlar.net
Source: KVKK