Major data scandal in Turkey: Information of thousands of customers stolen!

A serious data breach has occurred in the Turkish operations of the world-renowned luxury fashion giant Louis Vuitton. As a result of a cyberattack targeting Louis Vuitton Çantacılık Ticaret Anonim Şirketi, the personal data of exactly 142,995 customers was seized by malicious actors.

UNAUTHORIZED THIRD PARTY ACCESSED SYSTEMS

The Personal Data Protection Authority (KVKK), in its official statement regarding the data breach, announced that the attack took place through unauthorized third-party temporary system access. While pointing to serious vulnerabilities in data security, the authority stated that the scale of the breach has not yet been fully clarified.

“ATTACK DETECTED, MEASURES TAKEN”

Louis Vuitton officials stated that they intervened immediately after noticing the attack and reported the situation to the KVKK. The company expressed that the threat to its systems has been brought under control and that they have implemented additional cyber protection measures to increase security. Furthermore, an information process has been initiated for the customers affected by the attack.

WHICH DATA WAS SEIZED IS UNKNOWN

While the KVKK's statement did not include clear information regarding the content of the stolen data, it was reported that comprehensive technical analyses are ongoing.

The full statement made by the KVKK included the following:

''Public Announcement (Data Breach Notification) – Louis Vuitton Çantacılık Ticaret Anonim Şirketi

As is known, the 5th paragraph of Article 12 of the Personal Data Protection Law No. 6698, titled “Obligations regarding data security,” stipulates that “In the event that the processed personal data is obtained by others through unlawful means, the data controller shall notify the relevant person and the Board as soon as possible. The Board may, if necessary, announce this situation on its own website or by another method it deems appropriate.”

In the data breach notification submitted to the Board by Louis Vuitton Çantacılık Ticaret Anonim Şirketi, which holds the status of data controller, it is summarized that;

The breach began on June 7, 2025, and was detected on July 2, 2025,

The breach occurred through unauthorized access to the database containing customers' personal data; it was determined that a service account used by an administrator of a third-party service provider was compromised,

The group of data subjects affected by the breach are customers/potential customers,

The categories of personal data affected by the breach are identity and contact data, and investigations are ongoing,

142,995 people residing in Turkey were affected by the breach

information was provided.

While the investigation into the matter continues, it has been decided by the Personal Data Protection Board's decision dated 10.07.2025 and numbered 2025/1246 to announce the aforementioned data breach notification on the Authority's website.

Respectfully announced to the public.''

News Source: 12punto