Home About Us Services Awards Team Insights Career Contact Us TÜRKÇEENGLISH Devin Patent — Istanbul
Data Protection/Insights

Turkish Data Protection Board Decisions — October 2026 (II): The Data Breach Notifications of 21 October 2026

Kişisel Verileri Koruma Kurulu Kararları — Ekim 2026 (II): 21 Ekim 2026 Tarihli Veri İhlali Bildirimleri
Published26 October 2026
Reading time12 min
PDF
← All Insights
CategoryData Protection
Published26 October 2026
Contents01Introduction02Three Notifications Based on a Third-Party Software Library Vulnerability in Data Processor Systems03Two Notifications from the Health Sector04Notifications by Public Bodies05Two Notifications from the Accommodation Sector06Ransomware Attack on a Foundation's Server Infrastructure: Enka Spor Eğitim ve Sosyal Yardım Vakfı07Obligations Relating to Breach Notification08Conclusion
Devin Law & IP

This subject falls outside trademark and patent attorneyship. Legal services in this field are provided by our law firm, Devin Law & IP.

Go to devinlaw.com.tr →
SummaryÖzet

This legal update reports ten data breach notifications which the Personal Data Protection Board (“the Board”) decided, by its decisions dated 21 October 2026, to publish on the website of the Personal Data Protection Authority (“the Authority”). All of the notices were published on the Authority's website on 21 October 2026. The update covers announcements published on the Authority's website between 19 October 2026 and 25 October 2026; no new Board decision summary, resolution of principle or guide was published during this period.

Key takeaway · Kilit sonuç

By decisions dated 21 October 2026, the Board published ten data breach notifications; three attribute the breach to a third-party software library vulnerability in data processor systems and two to a ransomware attack.

01
Introduction

On 21 October 2026, the Board decided to publish ten data breach notifications on the Authority's website. Three of the notifications state that the breach occurred as a result of unauthorised access being gained to a server in the data processor's systems holding the data controller's data, by exploiting a security vulnerability in a third-party software library in use. Two notifications report a ransomware attack, two report unauthorised access to employee accounts by means of social engineering, one reports access to a corporate e-mail account by means of a compromised password, and one reports unauthorised access through the exploitation of a security vulnerability in software. One notification states that cyber security incidents directed at a hotel undertaking's information technology infrastructure and corporate e-mail accounts are under examination.

The published notifications include a notification concerning the encryption of a server holding the examination, test, diagnosis and treatment records of a private healthcare institution operating in Ankara, notifications by public bodies such as İzmir Büyükşehir Belediyesi and Ondokuz Mayıs Üniversitesi, and notifications by international group companies such as Choice Hotels International, Inc. and Baxter Turkey Renal Hizmetler AŞ. The number of affected data subjects is stated as a figure in five notifications, while the other notifications state that the number has not yet been determined. All of the notices state that the examination of the matter is ongoing; the publication decisions do not include any sanction in respect of the breaches.

02
Three Notifications Based on a Third-Party Software Library Vulnerability in Data Processor Systems

By the Board's decision No. 2026/2281 dated 21 October 2026, the notifications of Dermojet Sağlık Ürünleri Sanayi ve Ticaret Anonim Şirketi, Güllüoğlu Gıda San. ve Tic. AŞ and Kurukahveci Mehmet Efendi Mahdumları Gıda Sanayi ve Ticaret Anonim Şirketi were published. All three notifications state that the breach occurred as a result of unauthorised access being gained to a server in the data processor's systems holding the data controller's data, by exploiting a security vulnerability in a third-party software library in use, and that the breach was detected upon the notification made by the data processor to the data controller. The date of detection is given as 10 September 2026 in the Dermojet notification, 7 October 2026 in the Mehmet Efendi notification and 8 October 2026 in the Güllüoğlu notification.

According to the Dermojet notification, the data subjects' name and surname, telephone number, e-mail address, address information and hashed password/user login information were affected by the breach; the number of affected data subjects was reported as 50,636 and the affected group of data subjects as customers/potential customers. The Güllüoğlu notification states that the name and surname, telephone number, e-mail address, address information and stored password values of store customers, together with seller panel user accounts and stored password values, were affected by the breach, and that the number of affected data subjects is 67,193. The Mehmet Efendi notification lists the affected data as the name and surname, telephone number, e-mail address, address information and hashed password value of store customers, together with seller (administration) panel user accounts and the hashed stored password value; it states that the number of data subjects who may have been affected by the breach could consist of at most 15,303 end customers and 18 administration panel account holders. All three notifications state that data subjects may obtain information about the breach through the data controller's e-mail address, telephone number or website.

The Board's Assessment

All three notices contain the statement: “Although the examination of the matter is ongoing, by the Decision of the Personal Data Protection Board No. 2026/2281 dated 21 October 2026 it has been decided that the data breach notification in question be published on the Authority's website.” The notices contain no information on the identity of the data processor or on the software library exploited.

In the notification of Hüşyar Tekstil Paz. İth. İhr. San. Tic. Ltd. Şti., published on the Authority's website on 7 October 2026, the breach was likewise described, in the same terms, as unauthorised access gained to a server in the data processor's systems by exploiting a security vulnerability in a third-party software library, and the affected data were reported as the identity and contact information and stored password values of store customers. The notices contain no statement as to whether there is a connection between the four notifications.

03
Two Notifications from the Health Sector
DNC Sağlık Hizmetleri AŞ: Encryption of a Server Holding Health Records

The notification of DNC Sağlık Hizmetleri AŞ, published by the Board's decision No. 2026/2282 dated 21 October 2026, states that the data controller is a private healthcare institution providing healthcare services in Çankaya, Ankara, and that the breach was detected when the data controller's information technology personnel saw a ransom note in Turkish appearing on the server screen and it became apparent that the database files could not be accessed. According to the notification, patients receiving services from the data controller, patients' relatives, company personnel and business partners were affected by the breach.

The notification lists the personal data affected on the encrypted server, within the scope of the healthcare institution's activities, under four categories: identity data (name, surname, Turkish identity number), contact data (telephone number, address, e-mail address), health data as special categories of personal data (health records relating to examinations, tests, investigations, diagnoses, diagnostic findings, prescriptions and medical treatment history) and financial data (appointment records, invoicing and SGK/private insurance pre-authorisation records). It is stated that, because the server database was encrypted, the exact number of persons and records could not be determined at the initial stage.

Baxter Turkey Renal Hizmetler AŞ: Vishing-Based Social Engineering Attack

The notification of Baxter Turkey Renal Hizmetler AŞ, published by the Board's decision No. 2026/2292 dated 21 October 2026, states that the breach began on 4 August 2026 and was detected on 6 October 2026. According to the notification, a vishing-based social engineering attack targeting the data controller's employees was carried out by unauthorised third parties; this attack enabled “the threat actor to obtain employees' credentials and, through a single employee account, to access Baxter's Salesforce database and an internal data file functioning as Baxter's Active Directory”. It is stated that the affected personal data are basic business contact information such as name, e-mail address and postal address, that the affected group and number of data subjects have not yet been determined and that the examinations are ongoing.

04
Notifications by Public Bodies
İzmir Büyükşehir Belediyesi: Access to a Corporate E-Mail Account by Means of a Compromised Password

The notification of İzmir Büyükşehir Belediyesi, published by the Board's decision No. 2026/2271 dated 21 October 2026, states that it was detected on 30 September 2026 that e-mails were being sent in an unusual volume from a corporate e-mail account. According to the notification, it was established that access to the account in question was gained not through a security vulnerability in the e-mail server but by means of a previously compromised password.

The notification states that it was observed that the mailbox contents of two of the accounts to which unauthorised access had been gained were transferred outside the institution, that a rule was created to delete incoming messages, that bulk spam was sent, that message settings were changed, that existing correspondence was opened and that text of a fraudulent nature was added to the e-mail signature field. The affected personal data were reported as name, surname, e-mail address and internal telephone number; it is stated that the number of affected data subjects could not be determined precisely.

Ondokuz Mayıs Üniversitesi: Unauthorised Access Detected upon Notification by USOM

The notification of Ondokuz Mayıs Üniversitesi, published by the Board's decision No. 2026/2290 dated 21 October 2026, states that unauthorised access was carried out by exploiting a security vulnerability in software used by the data controller and that the personal data of 109 persons were obtained. The breach was detected on 14 October 2026 upon a notification received from the National Cyber Incident Response Centre (USOM). The affected categories of personal data were reported as identity, contact and location; it is stated that the affected groups of data subjects are not yet known.

05
Two Notifications from the Accommodation Sector
Choice Hotels International, Inc.

The notification of Choice Hotels International, Inc., published by the Board's decision No. 2026/2288 dated 21 October 2026, states that the breach occurred as a result of the threat actor gaining unauthorised access to the network account of a data controller employee by using a social engineering method, and that it was detected by means of an alert generated through the data controller's security monitoring controls. According to the notification, the breach began on 5 June 2026, ended on 6 June 2026 and was detected on 5 June 2026. The affected group of data subjects is customers; the affected personal data are name and surname and contact information and, for some of the affected persons, details relating to past hotel stays. The number of affected persons was reported as 9,550.

Akropol Turizm Yatırımları İnşaat ve Dış Ticaret Anonim Şirketi (MW Phokaia Beach & Resort)

The notification of Akropol Turizm Yatırımları İnşaat ve Dış Ticaret Anonim Şirketi, published by the Board's decision No. 2026/2285 dated 21 October 2026, states that cyber security incidents occurred directed at the information technology infrastructure and corporate e-mail accounts of MW Phokaia Beach & Resort, which is operated by the data controller. According to the notification, the corporate accounts suspected of having been subject to unauthorised access may contain personal data belonging to the data controller's employees and guests and to the natural person representatives of its suppliers and business partners; in this context, it is being investigated whether identity and contact information, information relating to natural persons contained in corporate e-mail correspondence, personal data relating to reservation and accommodation processes, employees' personnel and contact information, and financial or transaction information belonging to natural persons were affected by the breach. It is stated that an examination process is being conducted by the data controller in order to determine the start and end dates of the incident, the accounts affected, the categories of personal data, the number of data subjects and any transfer of data.

06
Ransomware Attack on a Foundation's Server Infrastructure: Enka Spor Eğitim ve Sosyal Yardım Vakfı

The notification of Enka Spor Eğitim ve Sosyal Yardım Vakfı, published by the Board's decision No. 2026/2284 dated 21 October 2026, states that a ransomware attack was carried out on the data controller's server infrastructure and that the technical examination of the attacker's method of entry into the system and of the full extent of the systems affected is ongoing. The affected groups of data subjects were reported as employees, students, former students and children.

According to the notification, the affected categories of personal data are identity data, consisting of the name and surname, date and place of birth, nationality, passport number and photograph information contained in copies of the passports of teachers, students and graduates, and visual and audio recordings, consisting of event photographs and passport photographs archived on the server. It is stated that the number of persons and records affected by the breach is not known at this stage.

07
Obligations Relating to Breach Notification
The Legislation Provides

Under Article 12(5) of Law No. 6698 on the Protection of Personal Data (“PDPL”): “Where the processed personal data are obtained by others through unlawful means, the data controller shall notify the data subject and the Board of this situation as soon as possible. Where necessary, the Board may publish this situation on its own website or by any other method it deems appropriate.” All ten notices refer to this provision and state that the publication decision is based on it.

Pursuant to the Board's decision No. 2019/10 dated 24 January 2019, the data controller must notify the Board without delay and within 72 hours at the latest from the date on which it becomes aware of the breach, and the data processor must notify the data controller without delay of any breach occurring within its organisation. In three of the notifications reported in this update, the breach occurred in data processor systems and was notified by the data processor to the data controller. The notices do not state the dates on which the notifications were made to the Board.

Board decision No.Data controllerNumber / group of data subjects affected
2026/2271İzmir Büyükşehir BelediyesiCould not be determined precisely
2026/2281Dermojet Sağlık Ürünleri Sanayi ve Ticaret Anonim Şirketi50,636; customers/potential customers
2026/2281Güllüoğlu Gıda San. ve Tic. AŞ67,193; store customers and seller panel users
2026/2281Kurukahveci Mehmet Efendi Mahdumları Gıda Sanayi ve Ticaret Anonim ŞirketiAt most 15,303 end customers and 18 administration panel account holders
2026/2282DNC Sağlık Hizmetleri AŞNot determined at initial stage; patients, relatives, personnel, business partners
2026/2284Enka Spor Eğitim ve Sosyal Yardım VakfıNot known at this stage; employees, students, former students, children
2026/2285Akropol Turizm Yatırımları İnşaat ve Dış Ticaret Anonim ŞirketiExamination process ongoing
2026/2288Choice Hotels International, Inc.9,550; customers
2026/2290Ondokuz Mayıs Üniversitesi109; groups not yet known
2026/2292Baxter Turkey Renal Hizmetler AŞNot yet determined
08
Conclusion

By its decisions Nos. 2026/2271, 2026/2281, 2026/2282, 2026/2284, 2026/2285, 2026/2288, 2026/2290 and 2026/2292 dated 21 October 2026, the Board published ten data breach notifications on the Authority's website. In the Dermojet, Güllüoğlu and Kurukahveci Mehmet Efendi notifications, the breach was attributed to unauthorised access gained to a server in the data processor's systems by exploiting a security vulnerability in a third-party software library; in these three notifications the number of affected data subjects was reported as 50,636, 67,193 and at most 15,303 end customers and 18 administration panel account holders, respectively. The DNC Sağlık Hizmetleri AŞ notification states that the server encrypted by a ransomware attack held patients' health records, and the Enka Spor Eğitim ve Sosyal Yardım Vakfı notification states that data contained in passport copies were affected by a ransomware attack.

In the Baxter Turkey Renal Hizmetler AŞ and Choice Hotels International, Inc. notifications, the breach was attributed to unauthorised access to employee accounts by means of social engineering; in the İzmir Büyükşehir Belediyesi notification, to access to a corporate e-mail account by means of a previously compromised password; and in the Ondokuz Mayıs Üniversitesi notification, to unauthorised access carried out by exploiting a security vulnerability in software. The number of affected persons was stated as 9,550 in the Choice Hotels notification and 109 in the Ondokuz Mayıs Üniversitesi notification; the Akropol Turizm notification states that the examination of the scope of the incident is continuing. All of the notices state that the examination of the matter is ongoing, and the publication decisions do not include any sanction in respect of the breaches.

Full briefing noteDownload the bilingual PDF version of this briefing note.
Download PDF

Related reading

Data ProtectionTurkish Data Protection Board Decisions — October 2026: The Resolution of Principle on the Monitoring of Corporate E-mail and Work Communication Channels and the Breach Notifications of 7 October 202612 October 2026Data ProtectionTurkish Data Protection Board Decisions — October 2026: Form of Response to Data Subject Applications and the Breach Notifications of 30 September 20265 October 2026Data ProtectionLawyers' Data Protection Obligations and Breaches at Data Processors28 September 2026