In the breach notifications published by Turkey's Personal Data Protection Board on 4 November 2026, the breach started at suppliers rather than on the companies' own servers. One incident involving live chat infrastructure affected 9,882 people.
The data breach notifications published by Turkey's Personal Data Protection Board on 4 November 2026 point to a pattern that keeps repeating: the breach rarely starts on the company's own server. It starts inside the systems of a supplier the company relies on.
The most widely reported of the batch came from e-commerce. According to the notification published under Board decision no. 2026/2438 of 04.11.2026, attackers gained unauthorised access to the systems of a data processor operating the live chat infrastructure on behalf of D-Market Elektronik Hizmetler ve Ticaret A.Ş. (Hepsiburada). The notification puts the number of affected individuals at 9,882. The exposed records are chat transcripts from 2022 and include names, mobile numbers, e-mail and postal addresses, along with order and shipment numbers and support or complaint histories. The company's own infrastructure was not the direct target.
Accommodation and travel appear in the same batch. Notifications for NCL (Bahamas) Ltd., Yazıcı Turizm Yatırımları ve İşletmeleri AŞ and Yazıcı Turizm Marmaris İşletmeleri A.Ş. were also published on the authority's site on 4 November 2026. The authority notes that its reviews are ongoing.
Why it matters
Article 12 of Law no. 6698 places the duty to secure personal data on the data controller and establishes joint liability with the data processor. Outsourcing a booking engine, a chat widget, call centre software or an accounting integration does not transfer that duty. The obligation to notify the Board within 72 hours of becoming aware of a breach also stays with the controller.
The financial exposure is not trivial. After the 25.49% revaluation rate published in the Official Gazette on 27 November 2025, administrative fines for failing to meet data security obligations run from TRY 256,357 to TRY 17,092,242 in 2026.
What this means for smaller companies
The layer that failed in these notifications is exactly the layer small and mid-sized businesses depend on most: an off-the-shelf chat plugin bolted onto the website, a hotel or agency reservation panel, an e-commerce platform, cloud accounting, external support and remote access tools. In most organisations nobody can say what data those systems hold, or for how long. The fact that 2022 chat transcripts were still reachable in the Hepsiburada case illustrates the problem precisely. A single incident at a supplier can mean your customer list leaves the building.
What Kamer Bilişim recommends
- Build a supplier inventory. Put every external system that touches your data into one table: which data categories, which retention period, which vendor, which contract. A supplier without a signed data processing agreement and a breach notification clause is an open finding waiting for an audit.
- Enforce retention limits. Chat logs, call recordings, old reservations and form submissions should not be kept indefinitely. Routinely deleting data you no longer need is the cheapest security control available — data that is not there cannot leak.
- Narrow integration access and plan the 72 hours in advance. Issue API keys to external software on a least-privilege basis, revoke the unused ones, and require multi-factor authentication on every admin panel. Then write down who calls whom during an incident, where the logs will come from, and who files the notification.
If you would like to review your supplier inventory, retention periods and integration permissions together, reach us through our contact page. We work on site across the Anatolian side of Istanbul and provide remote support elsewhere.
Source: Turkish Personal Data Protection Authority (kvkk.gov.tr) breach notifications and Board decision no. 2026/2438 of 04.11.2026; reporting by CHIP Online and LOG; 2026 fine amounts per CottGroup and Mondaq regulatory summaries.