Turkey's data protection authority, the KVKK, has published a fresh batch of breach notices in which the company that lost the data says the intrusion happened at a supplier holding it on its behalf. Ten notices published under Personal Data Protection Board decisions dated 4 November 2026 follow that pattern. Three of them involve a customer chat service, and the biggest name among them is the operator of Hepsiburada, one of Turkey's largest online marketplaces.
The other seven come from hotels, a travel agency and a winemaker, and all seven detected their breaches within the same four days in late October.
Old chat logs reach three familiar brands
D-Market Elektronik Hizmetler ve Ticaret, which runs Hepsiburada (its notice sends affected people to a Hepsiburada privacy mailbox), told the regulator that attackers gained unauthorized access to records held by the data processor that provides its chat infrastructure. The records are chat logs dated 2022. According to the D-Market notice, 9,882 people are affected: employees, customers and prospective customers, supplier staff, business partners and marketplace sellers. Exposed data includes names, phone numbers, email and postal addresses, order and shipment numbers, complaint records and purchase details.
D Fast Dağıtım Hizmetleri ve Lojistik, whose notice points to HepsiJet, the group's delivery service, filed in near-identical terms: its notice cites 2022 chat records at its chat provider, affecting 3,217 employees, customers and parcel recipients.
The third, Turksport Spor Ürünleri, routes questions to a Decathlon address. Its notice describes access to 541 chat records at the processor running its cloud-based call-centre and chat service, affecting 383 customers and employees.
All three sit under one board decision, 2026/2438, and KVKK does not name the processor. The matching language and the shared 2022 date in the two Hepsiburada group notices are consistent with a single chat supplier serving both, but neither notice says so, and nothing published establishes that Turksport used the same vendor. Chat transcripts from 2022 still sitting with a supplier in 2026 are a retention question as much as a security one.
Seven tourism firms, four days, one template
The tourism notices are thinner but strikingly uniform. Each says attackers reached the data processor systems holding the firm's data, exposing customers' identity, contact and transaction data, with the number affected still being determined. Detection dates run from 23 to 26 October:
- 23 October: Bengodi Boutique Hotel in Eceabat, Çanakkale (Bize Proje Geliştirme), winemaker Vinero Bağcılık, and Sveo Resort Kemer (Çamyuva Otelcilik)
- 24 October: Dalyan İztuzu Seyahat Acentası, a travel agency
- 25 October: Yazıcı Turizm Marmaris İşletmeleri
- 26 October: Yazz Otelcilik and Yazıcı Turizm Yatırımları
The two Yazıcı companies share a Grand Yazıcı Hotels contact. The tight detection window and identical wording point toward a supplier common to several of these businesses, but KVKK names no processor or product, and the notices are equally consistent with several providers running the same compromised software. See, for example, the Sveo Resort Kemer notice.
The same session also published a notice from NCL (Bahamas) Ltd., the Norwegian Cruise Line operator. Its filing says attackers exploited a flaw in a reservations web application, took names, email addresses, dates of birth and booking numbers for up to 2,392 people, and used them to send customers phishing emails.
These are not the first supplier-side breaches on Turkey's register this autumn. In September a processor breach exposed 6.2 million Turkish shoppers across retail and cosmetics brands, and in October we found that ransomware now fills half of Turkey's breach notices.
Treat any message quoting your order number with suspicion
Order, shipment and booking numbers are what make a phishing email believable, and the NCL case shows that abuse is real. Customers of these businesses should distrust messages that cite real order, delivery or booking details and then ask for a payment, login or card number, and should check through the company's own app instead of a link.
For businesses, the lesson sits in the contracts: ask chat, call-centre and booking providers how long they keep transcripts, require deletion when the purpose ends, and oblige them to report intrusions fast. In ten of these filings the controller had to tell the regulator about a breach on systems it did not run, and in two of them the data was already four years old.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.