Turkey's data protection authority published 12 new data breach notifications on 4 November 2026, almost all of them from hotels, resorts and travel agencies. The notification texts point to corporate email accounts and booking systems as the entry points.
Turkey's data protection authority, the KVKK, published 12 new data breach notifications on its website on 4 November 2026. Almost all of them came from one corner of the economy: hotels, resorts and travel agencies.
The authority's breach notification page lists data controllers including NCL (Bahamas) Ltd., Yazıcı Turizm Yatırımları ve İşletmeleri AŞ, Çamyuva Otelcilik İşletmeleri AŞ (Sveo Resort Kemer), Yazz Otelcilik Turizm İşletmeleri, Dalyan İztuzu Seyahat Acentası and Bize Proje Geliştirme AŞ (Bengodi Boutique Hotel). A separate notification from Akropol Turizm (MW Phokaia Beach & Resort), published under board decision 2026/2285 dated 21 October 2026, fits the same pattern.
Where the attackers got in: mailboxes and booking systems
The Akropol Turizm notification states that the incident stemmed from security events targeting the company's own IT infrastructure and corporate email accounts. The data categories under investigation include identity and contact details, information about individuals appearing inside corporate email correspondence, reservation and accommodation records, employee HR files, and financial and transaction data. The notification adds that the number of affected individuals has not yet been established and the review is ongoing.
That list is the part worth pausing on. The exposure is not limited to a customer database — staff personnel files and years of accumulated email correspondence sit inside the same scope.
Further up the booking chain, a different failure mode shows up. According to the Travelport International Operations Limited notification, published under board decision 2026/1797 dated 26 August 2026, an API configuration error in the ViewTrip application meant that records could be retrieved with only a booking reference, when the design required both a PNR number and a surname. The notification reports 73,958 affected individuals, while noting that the number of Turkey-based travellers may be lower because duplicate bookings could not be filtered out.
Why this matters beyond tourism
The sector concentration is a coincidence of timing; the mechanism is not sector-specific. Personal data in a small or mid-sized company usually sits in three places: corporate mailboxes, a line-of-business or order-and-booking application, and the integrations wiring the two together. A single compromised mailbox can hand over ID scans, signed contracts and payroll files sitting in attachments. The Travelport case makes the second point: a single mistake in authorisation logic can expose records even when nothing in the underlying infrastructure is technically vulnerable.
One practical consequence is worth spelling out. When a breach originates in a vendor's software, that does not transfer the obligation. Notifying the board and informing affected individuals remains the data controller's responsibility.
What we recommend at Kamer Bilişim
- Make multi-factor authentication mandatory on corporate email, with no exceptions. Administrator accounts and shared mailboxes (info@, accounts@, bookings@, reservations@) are the ones most often skipped. In the same pass, disable legacy protocols — they are the easiest route around MFA — and route sign-in logs into something that actually reports failed attempts.
- Get authorisation tested on customer portals, booking screens and order forms. The Travelport error was not a software vulnerability; it was a design decision. Ask of every form: can anyone who knows a reference number read the record behind it? If the software comes from a vendor, write that test into the contract.
- Build backups around a breach scenario, and write the notification workflow before you need it. Who examines which system, who drafts the regulatory notification, and which logs you actually hold should not be open questions on the day. An offline backup copy and access logs reaching at least six months back are the foundation.
If you run an office on Istanbul's Anatolian side and want to review corporate email security, authorisation design, backups or KVKK compliance, reach us through our contact page. We go through your current setup with you and produce a prioritised roadmap rather than a generic checklist.
Source: Turkish Data Protection Authority (KVKK) breach notification listings, 04.11.2026; board decisions 2026/2285 (21.10.2026) and 2026/1797 (26.08.2026)