All personal information of 108 million citizens stolen: BTK requested help from Google

The personal data of 108 million citizens registered with official institutions—consisting of their first and last names, Turkish ID numbers, family sequence numbers, individual sequence numbers, dates of birth, places of birth, the province, district, and village where they are registered in the population records, marital status, dates of death, residential addresses, and mobile phone numbers—has been stolen.

According to a report by Ali Safa Korkut from Free Web Turkey, the hackers who stole the data compiled it into five different Google Drive files named "Yenilenmiş TC" (Renewed TC), "Adres" (Address), "GSM", "101m", and "GSM" (a second file).

HELP REQUESTED FROM GOOGLE

The National Cyber Incident Response Center (USOM), which noticed that the data had been stolen, contacted Google and requested assistance, stating, "We are legally obligated to protect citizens against all kinds of cyberattacks, such as phishing attacks, user account takeovers, and data breaches."

USOM, which operates under the Information and Communication Technologies Authority (BTK), forwarded the links to the relevant Drive files to Google with the statement, "In this regard, we would like to bring to your attention that some data, which is claimed to be of critical importance, has been successfully uploaded to your system," and requested that they be removed "immediately" with an "urgent" code.

The total size of the five files, which contain the data of all citizens registered with any official authority in Turkey, regardless of whether they are citizens of the Republic of Turkey, is 42.18 GB.

WHAT IS AMONG THE STOLEN DATA

The stolen data includes the Turkish ID numbers of 108 million 571 thousand 832 people, the residential addresses of 82 million 322 thousand 190 people, and 134 million 817 thousand 279 mobile phone numbers.

The format of the files containing the personal data of millions of people is not XLS (Microsoft Excel) or CSV, which are the preferred formats for data recording. Due to the large size of the files, the hackers who stole the data saved them in the MYD and MYI formats of MySQL, a database management system.

MySQL is one of the database management programs capable of handling such large datasets. Since these and similar programs have the capacity to send hundreds of thousands of requests to a database simultaneously, those who want to process this data use such programs. 

IT HAD ALSO EMERGED IN 2023

USOM, which "requested" that Google cooperate, also asked for the user account IDs, IP addresses, and port numbers of the person or persons who uploaded the relevant files to Drive. 

In two separate letters sent to the company on July 29 and September 3, USOM stated, "Your prompt response to this matter is of great importance in terms of protecting the integrity and security of the affected users."

Free Web Turkey had also revealed that personal data was stolen in 2023 and filed a lawsuit against the Ministry of Interior upon this. After the lawsuit was dismissed, the MLSA Legal Unit, which took the issue to the Constitutional Court, argued that the administration, which showed negligence in protecting the data, violated the privacy of private life, freedom of expression, and the right to a fair trial. According to MLSA, the public disclosure of personal data poses a major threat to the millions of people whose information has been exposed.

News Source: 12punto