Data Breaches at 12 Turkish Companies Expose Records of Over 10 Million People

Turkey's Personal Data Protection Authority (KVKK) published 12 breach notices disclosing that security incidents at 12 companies exposed the personal data of a combined 10,218,802 customers and employees (an 11-company count; a 12th company had not yet determined its total). The largest was at cosmetics retailer Eve Kozmetik, affecting 6,263,305 customers after attackers exploited a vulnerability in a third-party software library on a data processor's server; retailer Shaya Mağazacılık reported 2,298,726 affected and boutique chain Deniz Butik reported 1,271,096. Exposed data included names, email addresses, phone numbers and, in some cases, home addresses and login credentials. KVKK said reviews of the breaches are continuing.