Cyber incidents targeting institutional systems show no signs of slowing down. The latest case to come to light was confirmed through an official announcement by Turkey's Personal Data Protection Authority (KVKK): a breach affecting personal data has occurred at Izmir Metropolitan Municipality.

How was the breach discovered?

dataic

According to the report filed with the authority, the incident came to attention on September 30, 2026, when an unusually high volume of messages was detected being sent from a corporate email account. That observation triggered the process of identifying the breach.

Initial technical reviews pointed to a notable finding: there was no direct security vulnerability either across the system or on the email server itself. Rather than exploiting a flaw on the server, the attackers gained direct access to the account using a valid password they had previously stolen.

Two mailboxes fully exported

Investigators determined that the entire contents of two of the compromised mailboxes had been transferred outside the organization. The attackers also set up special rules to automatically delete incoming messages in an effort to cover their tracks.

In addition, bulk spam was sent from the compromised accounts, message settings were altered, and existing correspondence was read. One of the most striking details of the incident was the addition of fraudulent text to the email signature fields.

Which data was affected?

According to the announcement, the types of personal data affected by the breach were first name, last name, email address and internal phone number. It is not yet clear how many people were affected; the investigation is ongoing.