On 11 November 2026, Turkey's Personal Data Protection Authority (KVKK) published seven data breach notices on its website. The notices name Pegasus Airlines, DHL AG, Air India, the Bursa Chamber of Commerce and Industry, Ethica Sigorta, Stemline Therapeutics, and Sadunoğlu İnşaat, the company that runs the Mard-Inn Hotel. The KVKK issued them under Article 12(5) of Turkey's Personal Data Protection Law No. 6698, which requires an organisation to tell affected people and the regulator as soon as possible when someone obtains personal data unlawfully. The two largest confirmed cases are Pegasus, where 11,762 employees and users had identity and contact data exposed after someone used an administrator password, and DHL, where 10,622 of its Turkey-based employees were affected through a survey supplier. Across all seven notices, tens of thousands of people had identity, contact and in some cases financial data exposed. The regulator says its investigation into every case is still open. Coverage by ThreatTicker, Kırmızı Ekip and antivirus.com.tr, all working from the KVKK's published summaries, agrees on the core facts. According to antivirus.com.tr's analysis, four of the seven breaches came in through a supplier or a supplier's supplier.
What Happened
Pegasus Airlines. The KVKK's notice (Board decision 2026/2486, as cited by SiberMagazin and Türk İnternet) says someone used an administrator password to get into the airline's internal IT request and development system without authorisation. The notice says it could not be determined how the password was obtained. The breach began on 12 October 2026 and was detected on 26 October, so the intruder had about two weeks inside before anyone noticed.
The notice also contradicts Pegasus's earlier public statement. On 4 November, after social media claims of a large leak, Pegasus said it had found a security vulnerability in its IT request and development systems. It said those systems were not critical to operations, and that "guest databases are not located in these systems and the systems are not used in running our flight operations." The KVKK notice lists "employees and users" as the affected groups. Ekometre, Türk İnternet and Yeni Alanya all report that wording as a conflict with the company's earlier reassurance. It is not clear who the "users" are. Teollimi, a breach-lookup site, reads the term as users of the internal IT system rather than passengers in general. The notice itself does not settle the question either way.
DHL AG. Someone gained unauthorised access to the data analysis and reporting environment of a processor DHL used for centrally run employee surveys. The breach was detected on 2 November and affected 10,622 people employed in Turkey.
Air India. Of the seven cases, this one lasted longest. According to antivirus.com.tr's reading of the notice, unauthorised access to reservation data began on 10 August 2023 and continued until 23 September 2026. Air India only learned of it on 3 November 2026, when the service provider processing its data told it. ThreatTicker reports that the exposed travel reservation data included masked card details.
Bursa Chamber of Commerce and Industry. Attackers used SQL injection to export members' identity, contact, membership and payment collection records. The breach was noticed on 2 November, when the database service stopped working. The number of people affected has not yet been determined.
Ethica Sigorta. Attackers accessed claims files through a vulnerability in software that a sub-supplier provided to the insurer's claims consultancy firm. The breach ran from 15 January to 14 February 2022, which means it was publicly disclosed nearly four years later. Reports differ on how much financial data was involved. ThreatTicker says national ID numbers and IBANs of "thousands" were exposed. Antivirus.com.tr's table, drawn from the notice, lists 3,091 licence plate numbers, 2,256 vehicle chassis numbers and 153 IBAN records, among other data.
Stemline Therapeutics. An attacker phoned staff pretending to be IT personnel from one of the company's sub-processors, then accessed employee accounts and cloud applications. Up to 18 patients' pseudonymised health data was affected.
Mard-Inn Hotel (Sadunoğlu İnşaat). Attackers hit the hotel's servers and its guest wireless network. Staff were locked out of systems and files, and guest data was taken. Detection is reported as 27 October. The number of people affected has not been clearly established.
What Was Taken
- Pegasus: identity and contact data for 11,762 employees and users. Teollimi describes this as names, phone numbers and email addresses. The notice does not mention financial data, card details, booking records or passport data.
- DHL: employee data for 10,622 people in Turkey, taken from a survey and reporting platform.
- Air India: travel reservation data, including masked card details according to ThreatTicker.
- Bursa Chamber: member identity, contact, membership and payment collection records. The number of people is not yet known.
- Ethica Sigorta: claims file data, including vehicle plate and chassis numbers and IBANs. Figures range from 153 IBAN records (antivirus.com.tr) to IBANs of "thousands" (ThreatTicker). ThreatTicker also reports that national ID numbers were exposed.
- Stemline Therapeutics: pseudonymised health data for up to 18 patients.
- Mard-Inn Hotel: guest data. The amount is unconfirmed.
Unverified claims about Pegasus. Before the notice was published, the social media account Dark Web Intelligence (@DailyDarkWeb) claimed that attackers had broken into Pegasus's Jira and Confluence servers, moved on into its AWS cloud environment, and stolen about 173 GB of data. Ekometre, Türk İnternet and Yeni Alanya report that the claim included roughly 430,000 Jira support tickets, 37,000 Confluence files and email addresses for 18,000 employees. The account also claimed that passenger booking records (PNRs), Turkish national ID numbers, passport numbers and flight details were taken. Neither the KVKK notice nor Pegasus has confirmed any of this. The confirmed scope is still limited to identity and contact data for 11,762 people. Pegasus called the social media claims misleading on 4 November.
Why It Matters
Suppliers are the main way in. By antivirus.com.tr's count, four of the seven breaches came through a third party: DHL's survey processor, Ethica's sub-supplier software, Stemline's sub-processor, and Air India's data processor. In two of those cases, Ethica and Stemline, the attacker went in through a supplier's supplier, a layer most contracts and audits never reach.
Some breaches went unnoticed for years. Air India's ran for more than three years, and the airline only heard about it from its supplier. Ethica's took place in early 2022. Bursa found its breach only when the database stopped working. Pegasus took two weeks to spot an intruder using an administrator account. None of these breaches was caught by the victim's own monitoring.
Company statements and regulator filings can disagree. Pegasus's 4 November statement that guest databases were not in the affected systems may be accurate. Still, the regulator's "employees and users" wording, published a week later, has left customers and reporters unsure what to believe. Defenders should give more weight to formal filings than to early press statements.
Internal tools hold more than they seem to. IT request and development platforms such as Jira and Confluence, if the unverified claims are accurate, often collect credentials, architecture notes, cloud access keys and personal data. Losing one can give an attacker a path into cloud infrastructure, which is what the Dark Web Intelligence account claims happened at Pegasus.
The Attack Technique
The seven notices describe several different ways in:
- Valid administrator password (Pegasus). The attacker did not exploit a software flaw. They logged in with a working admin password. SiberMagazin notes it is unknown whether the password came from phishing, infostealer malware, reuse of a password exposed elsewhere, or some other route. Either way, a single administrator account gave access to thousands of people's records.
- SQL injection (Bursa Chamber). A classic flaw in a web application that lets an attacker run their own database queries, used here to export bulk records.
- Supplier software vulnerability (Ethica Sigorta). A flaw in software used by a sub-supplier of the insurer's claims consultancy.
- Phone impersonation of IT support (Stemline). The attacker called staff, posed as IT personnel from a sub-processor, and used that to take over employee accounts and get into cloud applications.
- Server and network intrusion with lockout (Mard-Inn Hotel). The attack on servers and guest Wi-Fi blocked staff from their systems and files. That pattern fits ransomware, although the notice as reported does not use the word.
- Compromise at the processor (DHL, Air India). Attackers accessed environments run by the suppliers, not by DHL or Air India themselves.
No threat actor has been publicly named for any of the seven breaches.
What Organizations Should Do
- Put hardware-key MFA on every administrator account, including on internal tools. Treat IT request, ticketing and wiki platforms as important systems. Require phishing-resistant MFA for admin access, and alert on admin logins from new devices, locations or times. Pegasus's two-week gap before detection is the scenario to plan against.
- Check whether staff passwords have been exposed. Monitor infostealer logs and credential leak feeds for your domains, and force password resets when you get a match. Ban password reuse between corporate and personal accounts.
- Write supplier breach-notification deadlines into contracts, and extend them to sub-processors. Contracts should require processors to report breaches within a set number of hours and to pass the same requirement down to their own suppliers. Ask suppliers for evidence of their logging and access controls, not just a questionnaire. Air India's three-year gap shows what happens without this.
- Limit what goes to processors. Share only the minimum data survey platforms, analytics vendors and claims tools need. Pseudonymise it where you can, as Stemline did, which kept its exposure to 18 patients. Delete data on a fixed schedule.
- Make help-desk impersonation calls fail. Verify any caller who claims to be IT support, whether internal or from a vendor, by calling back on a known number. Never approve MFA resets or account changes based only on an incoming call.
- Test web applications for injection flaws and watch database behaviour. Use parameterised queries, scan public-facing applications regularly, and alert on unusually large data exports. Do not wait for a service outage to find a breach.
Sources: Turkey's data authority discloses a wave of breaches at Pegasus, DH... | KVKK'dan Pegasus için ihlal duyurusu: ele geçirilen admin parolasıy... | Pegasus'ta veri ihlali: 11 bin 762 kişi etkilendi - Ekometre | Pegasus 173 GB Veri Sızıntısı İddiasını Yalanladı Ama KVKK'ya 11.76... | KVKK veri ihlali bildirimleri: 7 ihlalin 4’ü tedarikçiden geldi | Pegasus siber saldırısı: 11 bin 762 kişinin verisi sızdı - Antalya... | KVKK yedi veri ihlali bildirimi yayımladı, Pegasus'ta 11.762 kişi e... | Pegasus Airlines data breach (Nov 2026): was I affected?