KVKK data breaches: ISO 27001 lessons for SMBs

On 30 September 2026, KVKK published data-breach notices for nine companies. At least 1,033,853 people were affected in total. This article covers only the causes stated in public and how they map to ISO/IEC 27001:2022 Annex A controls. Source: memurlar.net report.

What was published?

The numbers of people affected in the KVKK notice include: Efece 353,811; Bambi 323,052; Ofix 183,873; Deve Yükü 133,031. Unigen, Papara Menkul and the other companies appear with different levels of detail; for Papara Menkul the number of people affected was not disclosed.

Stated causes

Only some notices name a cause. For Ofix, unauthorized access to Elasticsearch is stated. For Unigen, a flaw in a third-party library is stated. For Papara Menkul, a phishing email led to unauthorized access to the Okta SSO platform of its overseas data processor. Malware delivered through a third-party application is also among the causes.

We do not assign a cause to any company where the notice does not name one. We also make no comment on fines or penalties.

Mapping to ISO 27001 controls

The same root causes have counterparts in ISO/IEC 27001:2022 Annex A. The certificate comes from an accredited certification body; the consultant does not issue the certificate. Doğa Network provides consulting and does not certify.

An internet-facing, poorly configured database points to weak configuration management (8.9) and networks security (8.20). A third-party library flaw relates to management of technical vulnerabilities (8.8). A breach at the processor side recalls supplier-relationship controls (5.19–5.22). Phishing is a matter of information security awareness, education and training (6.3). Malware maps to protection against malware (8.7).

Under KVKK, the data controller remains responsible even when a processor is breached. That general rule also shows why a security clause in a contract is not enough on its own: monitoring and review are required.

First steps for an SMB

1. Inventory of internet-facing services: which server, which port, which application is visible from outside.
2. Patch and dependency tracking: a record of versions and patches for the OS, applications and third-party libraries.
3. Supplier list and contract security clauses: who processes which personal data, and who informs whom on a breach.
4. Phishing-resistant multi-factor authentication: especially for admin panels and SSO.
5. A breach response plan: who decides, and who informs KVKK and the affected people, and when.

These five items are a practical start toward reducing a repeat of the stated causes.

The published breaches show that a control list must not stay on paper.

How can Doğa Network help?

Our team can support an ISO 27001 gap analysis, supplier security clauses, awareness training and a breach response plan. Call us on +90 850 888 3642 or email hi@doga.network.