Dermojet, Karaköy Güllüoğlu and Mehmet Efendi report web store breaches to KVKK

Turkey's Personal Data Protection Authority (KVKK), the country's data protection regulator, published breach notifications on October 21, 2026 for three consumer brands: cosmetics and health products maker Dermojet, baklava producer Güllüoğlu Gıda (Karaköy Güllüoğlu) and coffee company Kurukahveci Mehmet Efendi. According to the notices, all three incidents involved unauthorized access to a server operated by a data processor, achieved by exploiting a security vulnerability in a third-party software library. Combined, the notified figures exceed 130,000 people.

The notices were published under Article 12/5 of Turkey's Personal Data Protection Law No. 6698, following a decision by the Personal Data Protection Board dated October 21, 2026.

What happened

KVKK's announcements use nearly identical language for the three cases. In each, the data processor, the third party that handles data on the company's behalf, notified the data controller that a server holding the controller's data had been accessed without authorization through a flaw in a third-party library. The notices do not name the processor, the software platform or the vulnerable library, and they do not state when the intrusions began.

According to KVKK, the breaches were detected on the following dates:

• Dermojet: September 10, 2026
• Kurukahveci Mehmet Efendi: October 7, 2026
• Güllüoğlu Gıda: October 8, 2026

The notices do not say whether the three incidents are connected, and that should not be assumed on the basis of their similar wording alone.

Who is affected

KVKK's notices list the following scope:

• Dermojet: 50,636 customers and prospective customers. Affected data includes full names, phone numbers, email addresses, postal addresses and hashed passwords or login information.
• Güllüoğlu Gıda: 67,193 users. Store customers' names, phone numbers, email and postal addresses and stored password values were affected, as well as seller panel account information and its stored passwords.
• Kurukahveci Mehmet Efendi: up to 15,303 end customers and 18 administrative panel account holders. Customer names, phone numbers, email and postal addresses and hashed passwords were affected, along with admin panel account data and hashed passwords.

KVKK says the investigations are still ongoing. The notices do not detail what technical measures the companies have taken.

What to do

Customers of these web stores should change their passwords on the affected sites and on any other service where the same password was used. Because names, phone numbers and addresses were exposed, they should also be wary of SMS, email or phone calls that pose as order, delivery or refund notifications from these brands. Businesses running online stores through third-party platforms should ask their providers whether they are affected by vulnerable libraries and ensure that panel accounts use strong, unique passwords and multi-factor authentication.

According to the notices, affected individuals can contact Dermojet at [email protected], Güllüoğlu at [email protected] or its call center, and Mehmet Efendi at [email protected].