Massive Data Breaches Expose Over 10 Million Records Across 12 Turkish Companies Turkey’s data protection regulator revealed on September 16 that 12 companies suffered data breaches affecting over 10.2 million customers and employees, with one firm still unable to determine the full scope of the exposure. The incidents, disclosed under Turkey’s Personal Data Protection Law, highlight widespread vulnerabilities in third-party software and data processing systems. The largest breach occurred at Eve Kozmetik, a cosmetics retailer, where 6.26 million records including names, email addresses, and phone numbers were compromised. The company reported that attackers exploited a vulnerability in a third-party software library on a server operated by a data processor, with the breach detected on September 10. Two subsidiaries of Kuwait-based Alshaya Group Shaya Mağazacılık and Shaya Kahve also reported significant breaches. Shaya Mağazacılık exposed 2.3 million records (names, emails, and home addresses), while Shaya Kahve affected 133,999 individuals. The group operates major brands in Turkey, including Starbucks, Victoria’s Secret, and Bath & Body Works. Other notable breaches included: - Deniz Deniz Butik: 1.27 million records (usernames, phone numbers, emails) compromised via a third-party software vulnerability. - Haşema Tekstil: 95,857 affected. - Yiğit Alışveriş Merkezleri: 81,593 affected. - Valmenti Mağazacılık: 32,292 affected. - Taşkınırmak Giyim: 29,265 affected. - İyileştiren Mamuller Gıda: 6,547 affected. - Back and Bond: 5,435 affected. - Mersin Mana Tarım: 695 affected. İnternet Tekstil Sanayi ve Ticaret A.Ş. reported potential exposure of names, phone numbers, emails, postal addresses, and login credentials but has not yet confirmed the number of affected individuals. Like several other breaches, the incident stemmed from a vulnerability in a third-party software library. While the regulator has not confirmed whether the breaches were part of a coordinated attack, multiple incidents involved unauthorized access to third-party systems. Under Turkish law, companies must notify affected individuals and the regulator "as soon as possible" when personal data is unlawfully obtained. The regulator’s investigations into the breaches remain ongoing.