THE Turkish Data Protection Authority (KVKK) has completed its investigation into the Baydöner data breach, finding that the kebab chain failed to detect unusual system activity due to an absent alarm mechanism. The authority imposed administrative penalties totalling 1 million Turkish Lira, covering data security and notification obligations. The breach involved cybercriminals gaining access through an employee credential and subsequently copying customer data from Baydöner’s information systems.
In the incident, the attackers obtained the full names, genders, email addresses, phone numbers and cities of residence for 505,337 customers. After the data was copied, the criminals reportedly notified a senior company executive that the data were in their possession, prompting Baydöner to file an official notification with KVKK and trigger the review process.
The report notes that the breach highlights gaps in detection and governance, and the KVKK action underscores the importance of timely breach notification and robust access controls.