On 1 October, ransomware hit the virtualisation platform and servers of Yıldız Technical University in Istanbul. The university told Turkey's data protection authority (KVKK) that about 140,000 students and 4,500 staff may be affected, along with an as yet uncounted number of visitors, and that it could not yet say which categories of personal data were touched. The regulator published the notice under Board Decision 2026/2203 of 7 October.
The university is not an isolated case. Of the 25 KVKK breach notices IntelFusions has recorded with dates from 28 September onward, 13 describe ransomware or systems that were encrypted and locked. Across the 111 notices we recorded from June to late September, the figure was 17. Through the summer, the register was dominated by e-commerce brands whose data processors were breached through a vulnerable third-party library, a wave we covered in September.
One call-centre outage, many notices
The largest single cluster sits around 30 September. Four related companies, PCT Yazılım, PCX Operasyon, Procat Teknoloji and Procatcx Operasyon, each reported a ransomware attack that day, detected the same day. The PCT notice lists employee HR files (including data from old-style ID card copies), job applicants' CVs, and call-centre call detail records and voice recordings among the data that may be affected, and says no data exfiltration had been established yet.
On the same date, three other companies told the KVKK that the call-centre provider they rely on had been attacked. D Elektronik Şans Oyunları and 4 Race Teknoloji filed near-identical notices: the provider noticed a service outage on 30 September, found its data encrypted, and while it saw no sign of exfiltration at first, said unauthorised access could not be fully ruled out given how long the attacker was in the systems and that the infrastructure was shared. Insurer GIG Sigorta reported that one day of call recordings held by its IVR and archiving provider was encrypted, leaving 161 calls inaccessible. None of these notices names the provider, so whether they all describe the same incident is not established.
Health records and a Turkish ransom note
Three more companies, Ortadoğu Holding, Medikalyapı Sağlık Yatırımları and Gür Grup İnşaat, reported in matching language that outsiders accessed their systems on 3 October and encrypted their data. Baby-clothing maker Monnalisa reported a ransomware attack on 28 and 29 September and said it could not count those affected because its files were locked.
The most sensitive notice came last. DNC Sağlık Hizmetleri, a private healthcare provider in Ankara's Çankaya district, said its IT staff found a Turkish-language ransom note on a server screen in October. The encrypted database held patients' national ID numbers, examination, test, diagnosis and prescription records, and billing and insurance claim data. Not every recent notice involves ransomware: İzmir Metropolitan Municipality reported that attackers logged into corporate mailboxes with previously compromised passwords, exported two mailboxes, and added inbox-deletion rules and fraudulent text to email signatures.
Read the dates as notice dates
The KVKK publishes these notices in batches under board decisions, and several give only a detection date or none at all, so the shift above is a change in what companies are reporting, not a precise timeline of attacks. None of the notices names a ransomware group. For organisations in Turkey, the practical lessons are familiar ones: offline and tested backups for virtualisation hosts, contractual breach-notification terms with call-centre and IVR providers, and multi-factor authentication on mail accounts, the control most relevant to a login with a stolen password like İzmir's. The summer's leaks came through other companies' code; this autumn's notices mostly describe locked servers.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.