Officials had denied that the personal data of 108 million citizens was stolen: Allegations that they are not telling the truth

Following the report by journalist Ali Safa Korkut from Free Web Turkey, the claim that the data of 108 million people had been stolen had come to the agenda.

Making a statement regarding the news that Minister of Transport and Infrastructure Abdulkadir Uraloğlu had confirmed that the identity information of 85 million citizens was stolen during the pandemic, the Center for Combating Disinformation stated that there was "no currently" leaked data.  

After the issue of 108 million people's data being stolen and the BTK requesting help from Google came to the agenda and the claims were denied, Korkut published the documents. 

According to the news on Free Web; in his first statement, Uraloğlu confirmed the data leak, stating that it only happened during the pandemic and originated from the Ministry of Health's system.

This is not true. Because the leak did not only happen during the pandemic, but also afterwards. At the same time, data was stolen from the Ministry of Labor and the Ministry of Interior, as well as the Ministry of Health.

As evidence, I can point to my report titled “All SGK service information of 21 million workers and employers was stolen,” which we published on Thursday, September 12.

The report describes the theft of the registered employee information of over 20 million citizens in the Social Security Institution (SGK) and the personal and authorized information of over 1 million employers registered in the SGK system.

When the stolen data is examined, it is seen that entry information for Thursday, December 28, 2023, is included among the SGK records affiliated with the Ministry of Labor and Social Security. This strengthens the possibility that the data was stolen on this date.

"I WILL PRESENT ANOTHER EXAMPLE"

Stating, 'I will present another example showing that the leak did not only occur during the pandemic period, contrary to what Uraloğlu said,' Korkut continued as follows:

On March 6, 2024, in the report published on T24 titled “T24 investigated as a 'buyer': The final act in the data theft scandal; everyone's personal information in Turkey, including political leaders, is on sale for 150 liras!”, it was revealed that all personal data was sold for 150 TL.

Cengiz Anıl Bölükbaş noted in his report that he searched for his own residential address and found his current address, which he had changed only two months prior, among the stolen data.

Bölükbaş stated in the report that the stolen and sold data also included citizens' hospital appointments and prescribed medication information.

Presenting a screenshot of this, Bölükbaş documented that he reached his examination record at the Ankara 29 May State Hospital Ear, Nose and Throat Polyclinic on February 8, 2024, and even the prescription provided to him.

Another piece of evidence showing that the leak did not originate only from the Ministry of Health, contrary to what Uraloğlu said.

In July, reports were made that the personal data of 3 million 300 thousand Syrian refugees registered in Turkey, as well as copies of their passports, had been leaked.

How this information, which was only available at the Ministry of Interior's Presidency of Migration Management, was leaked could not be determined. However, the Presidency of Migration Management confirmed the leak. The Presidency, however, said that the leaked information did not match current data.

WHAT DO WE UNDERSTAND FROM ALL THIS?

The explanation that the leak only happened during the pandemic, is not current, and only originated from the Ministry of Health is not true.

The statement made by the Directorate of Communications that “There is no currently leaked data” is not true.

The claim that there is no current leak, put forward in Uraloğlu's statement, "Let no one report as if there are current things stolen regarding people's security and data in Turkey," is not true.

IF HELP WAS NOT REQUESTED FROM GOOGLE, WHAT ARE THESE?

Another institution that denied the report titled “All personal data of 108 million citizens was stolen, BTK admitted it could not protect the data and asked for help from Google” was the Presidential Directorate of Communications Center for Combating Disinformation (DMM).

In the statement made on September 12, the phrases “Just as there is no currently leaked data, there is no question of asking for help from Google” were used.

The only institution that did not make a statement regarding this issue was the Information and Communication Technologies Authority (BTK), which wrote three separate letters to Google to have the relevant Drive files removed from publication.

No statement has come from BTK yet because, contrary to the DMM's statement, BTK did ask for help from Google regarding the removal of the Drive files where the stolen personal data was stored.

I am sharing the document of the application dated July 29 by BTK, which wrote to Google on July 29, September 3, and September 6 to have the Drive files removed. This document shows that Google received a content removal request from the National Cyber Incident Response Center (USOM) within BTK, and the content removal record created by Google upon this.

*Since these files were removed by Google, the links belonging to the relevant Drive files in the images have been shared without censorship. 

GOOGLE REMOVED THE FILES AFTER FREE WEB TURKEY REPORTED THE SITUATION

You can see the links of the Drive files that BTK requested to be removed in the letter it sent.

However, the files that the institution requested to be removed with the letter it wrote on July 29 were not removed until the situation was reported on Free Web Turkey. 

To support my claim, I am also attaching the screenshots I took on September 4, five days before the news was published.

You will see that the URLs in the address bar above match the URLs included in the letter written by BTK.

In the screenshots below, you can see that Google removed the relevant files from publication after the news was published.

When one tries to visit the relevant files, Google gives the warning, “Unfortunately, you cannot access this item because it violates our Terms of Service.”

USOM ALSO CONTACTED GOOGLE FOR BORSA ISTANBUL

In addition to these, USOM, affiliated with BTK, also contacted Google on May 17, 2024, this time for Borsa Istanbul (BIST).

In the application made to Google, a "phishing attack" targeting BIST was mentioned, and the existence of a link aimed at stealing people's information was discussed. In the application letter, USOM requested the removal of a website created using the "Google Sites" tool, which allows the creation of websites, with the phrase, "In light of these developments, we urgently request that the content be removed from your system immediately."

However, since Google removed this website from publication, I could not see what was in the content of the site in question. Therefore, it is not correct to characterize this as a data theft either.

QUESTIONS TO GOVERNMENT OFFICIALS WHO DENIED THE NEWS

Korkut directed the following questions to government officials:

1-What is the reason for the contradiction between the statement made by Minister of Transport Abdulkadir Uraloğlu on September 9, which confirmed the leak, and the statement he made on September 16, which denied the leak?

2-Despite Uraloğlu's statement on September 9 that "the leak only happened during the pandemic, there is no current leak," how does Uraloğlu explain the findings that show there are also current leaks, which were both revealed by journalist Cengiz Anıl Bölükbaş in his own report and by me in my report titled "All SGK service information of 21 million workers and employers was stolen" dated September 12, 2024?

3-As citizens whose personal data has been stolen, should we take into account Uraloğlu's statement on September 9, which confirmed the data leak, or his statement on September 16, which denied the leak?

4-If we are to take his statement on September 9 into account, do officials find Uraloğlu's statement that "the leaks during the pandemic unfortunately could not be prevented" sufficient for such a massive leak? Do they think this statement contains the necessary self-criticism and responsibility?

5-Again, if we are to take his statement on September 9 into account, if we as Free Web Turkey had not uncovered this data leak, would the Ministry of Transport not have announced that the data was stolen and would those responsible not have been held accountable?

6-If help was not requested from Google, how does the Directorate of Communications explain the letters dated July 29, September 3, and September 6 sent to the company?