Massive Data Breach Exposes Personal and Medical Records of 364,000 in Northern Cyprus A significant cybersecurity incident has exposed the personal and medical records of over 364,000 individuals in the Turkish Republic of Northern Cyprus (KKTC), a territory recognized only by Turkey. The breach, first reported by the Turkish Cypriot newspaper Yenidüzen, involves data from the KKTC’s public health system, affecting both citizens and foreign nationals who received healthcare in the region. Cybersecurity experts in the Netherlands verified the authenticity of the leaked files, describing it as one of the largest data breaches in the territory’s history. The compromised database includes names, identity numbers, birthplaces, addresses, and family details, with records spanning 202 nationalities. Hackers also claimed to possess a separate database containing HIV/AIDS diagnoses, though this has not been independently confirmed. Additionally, they alleged access to entry and exit records for approximately 340,000 travelers to northern Cyprus. Transportation Minister Erhan Arıklı acknowledged the breach as a credible threat, stating that government systems had previously been targeted by cyberattacks. He admitted that the KKTC lacked sufficient technical personnel to respond effectively and revealed that officials had requested cybersecurity assistance from Turkey while establishing a new defense unit. Despite initial denials from authorities, Yenidüzen published screenshots from a dark web forum where hackers advertised the stolen data. The breach first appeared online on January 8 but went largely unnoticed for months, prompting opposition politicians to question why the public was not informed sooner. The incident has drawn sharp criticism from professional organizations and opposition parties. The Chamber of Computer Engineers called for an independent investigation, framing the breach as a national security issue rather than just an IT failure. The Cyprus Turkish Medical Association warned that if confirmed, this would be the largest data leak in the territory’s history, eroding public trust in the government’s ability to protect sensitive information. Opposition leaders, including the Republican Turkish Party (CTP), accused the administration of neglecting cybersecurity, leaving critical systems vulnerable due to insufficient funding, staffing, and legal protections. The breach also raises concerns about the security of the KKTC’s Turkey-backed digital infrastructure, including its e-government portal, which relies on systems developed by Turkey’s state-owned Türksat. This incident follows broader scrutiny of data security in Turkey, where a separate breach in September 2024 exposed the personal details of over 108 million citizens. The KKTC breach underscores persistent vulnerabilities in regional cybersecurity frameworks, particularly in government-operated health and digital identity systems.