KVKK discloses ransomware at Ankara clinic DNC Sağlık and vishing breach at Baxter Turkey

Turkey's Personal Data Protection Authority (KVKK), the country's data protection regulator, published two new data breach notices on October 21, 2026 involving the healthcare sector: a ransomware attack on DNC Sağlık Hizmetleri, a private healthcare provider in Ankara's Çankaya district, and a social engineering attack on Baxter Turkey Renal Hizmetler, the Turkish renal services unit of Baxter. The notices were published under Article 12(5) of Law No. 6698 on the Protection of Personal Data, which requires data controllers to notify the authority and affected people when personal data is obtained unlawfully by others. In both cases, the number of affected people has not yet been determined.

DNC Sağlık: patient database encrypted

According to KVKK's notice, IT staff at DNC Sağlık Hizmetleri AŞ noticed a Turkish-language ransom note on a server screen in October 2026 and found that database files could no longer be accessed. The notice describes the incident as a ransomware attack in which the server's database was encrypted. It does not give an exact start date or explain how the attackers gained access.

The affected groups are patients, patients' relatives, company staff and business partners. KVKK lists identity data such as names and Turkish national ID numbers; contact details including phone numbers, addresses and email addresses; special category health data including examination, test, diagnosis, prescription and treatment history; and financial records covering appointments, billing and social security or private insurance authorizations. Because the database was encrypted, the controller could not determine the exact number of people or records at the initial stage. KVKK's board ordered publication with decision No. 2026/2282, and the investigation is ongoing.

Baxter Turkey: phone phishing led to Salesforce access

KVKK says the breach at Baxter Turkey Renal Hizmetler AŞ began on August 4, 2026 and was detected on October 6, 2026, more than two months later. Attackers carried out a social engineering attack using voice phishing calls targeting company employees. After obtaining employee credentials, they used a single employee account to access a Salesforce database and an internal data file that functions as an Active Directory.

The exposed data consists of basic business contact information such as names, email addresses and postal addresses. The affected groups and number of people have not yet been determined. Publication was ordered with board decision No. 2026/2292, and the review is continuing.

What to do

Patients of DNC Sağlık and their relatives should be wary of calls, messages or emails that cite their medical history or insurance details, and should not share identity or banking information in response to unexpected requests. Because national ID numbers were involved, they should also watch for attempts to open accounts or lines in their name. Contacts of Baxter Turkey should treat unsolicited messages that appear to come from the company with caution. For organizations, the Baxter case is another reminder that phone-based social engineering against staff can open access to cloud CRM platforms; help desk identity verification and phishing-resistant multi-factor authentication reduce this risk.