2 notifications in 1 day: Data of 170 thousand people stolen

The Personal Data Protection Board (KVKK) publishes data breaches occurring on its website. According to the latest data, 2 institutions reported data breaches on November 30 alone, and the data of nearly 170 thousand people was stolen.

Institutions and organizations are required to report data breaches in their systems to the KVKK. Notifications made within this scope are published on the KVKK's website. The public frequently and continuously discusses how data is stolen, sold for money, and returned to users in the form of fraud. However, despite all these discussions, the measures taken are not sufficient. According to the information provided by the KVKK on November 30, the Union of Turkish Chambers of Agriculture (TZOB) and Kaymek Kayseri Vocational Education and Culture Inc., which operates under the Kayseri Metropolitan Municipality, submitted data breach notifications to the KVKK.

According to the notifications, 162 thousand people were affected by the data breach at TZOB. The statement included the following information:

“The breach occurred on 20.11.2023 and was detected on 21.11.2023,

It was understood that MERNIS web service queries were performed from different IP addresses using the account information of a user registered in the Chamber of Agriculture Information System (ZOBIS),

The Turkish ID numbers used in the query were numbers not kept in the ZOBIS database,

The group of data subjects affected by the breach has not yet been identified,

The data affected by the breach consists of identity data.”

THEY CLICKED THE LINK AND HAD THEIR DATA STOLEN

In the notification from Kaymek Kayseri Vocational Education and Culture Inc., the number of people affected by the data breach was announced as 7,186. Among the data affected by the breach, the mention of race and ethnic origin information drew attention. The notification included the following statements:

“The breach occurred by clicking on a link received via e-mail,

The breach was detected through a letter sent to the data controller by the Information Technologies Department of the Information and Communication Technologies Authority,

The group of data subjects affected by the breach are students,

The categories of personal data affected by the breach are identity, contact, location, personnel, and race and ethnic origin information from the special categories of personal data.”

Kaymek officials, whom we reached by phone, confirmed the breach but stated that they had provided all information to the KVKK and would not make any further statements.

News Source: 12punto