Striking detail in CİMER scandal: They even stole Erdoğan's data!

A new concern has been added to the growing worries regarding the security of personal data. Following a tip-off made to CİMER in 2021, it was revealed that personal data, including the Turkish ID numbers of President Recep Tayyip Erdoğan and some ministers, had been leaked to others.

In this scandal, the suspects gained access to many of the state's systems. According to the indictment, the personal data of many individuals, from the President to ministers, was transmitted to others by a suspect.

DETAILS IN THE INDICTMENT

The indictment numbered 2022/13270, prepared by the Diyarbakır Chief Public Prosecutor's Office, drew attention to a major breach regarding the security of personal data.

According to information revealed by Cumhuriyet columnist Barış Terkoğlu regarding the indictment, an examination of suspect H.A.'s mobile phone determined that he had sent data containing the names, surnames, and Turkish ID numbers of President Erdoğan and some ministers to others.

Another important detail in the indictment was H.A.'s access to state systems, particularly ÖSYM (Student Selection and Placement Center) and municipal data. H.A. stated that he accessed this data systematically and created a program to integrate it into his own applications.

THEY WERE ABLE TO PERFORM EVERY OPERATION, FROM E-SCHOOL TO CİMER, AND EVEN MARKING PEOPLE AS DECEASED IN SYSTEM RECORDS

The indictment included the following statements:

"In the investigations conducted into the illegal activities of the child offenders (SSÇ) and suspects whose identities were determined within the scope of the file; it was understood that by using different methods, they gained access to the Ministry of Health's Public Health Management System and were able to show individuals who made requests as having contracted COVID-19 or as being in contact with INFECTED persons, were able to issue prescriptions via health reports and E-prescriptions, were able to access the Ministry of National Education's E-School system to perform operations such as changing grade information, were able to log into the Pol-Net system to perform GBT (criminal background) checks, were able to access some insurance companies to issue insurance and motor vehicle insurance policies, were able to perform vehicle license plate inquiry operations, were able to access the Ministry of Interior's Population records to close system records by marking people as deceased, were able to perform address changes or family registry inquiry operations, etc., were able to access the CİMER system to track applications and information, were able to access the Council of Higher Education's university systems to obtain personal data such as personal information, photos, phone numbers, and addresses of individuals, and were able to access municipal systems to perform marriage procedures. It was understood that they could access all personal data such as Turkish ID numbers from names and surnames, GSM numbers, vehicle information, land registry information, and workplace information, and that they generated income by selling personal data by opening member registrations on illegal sites established with solver/scanner features called checkers (hicheek, checkworld, jitemcheck, wicheck, axenta, jigcheck, lars, etc.) and defining a certain number of query rights according to the membership type for those who requested them."