KVKK discloses supplier-linked breaches at Asyaport and online store elevti.com

Turkey's Personal Data Protection Authority (KVKK), the country's data protection regulator, published two new data breach notices on October 27, 2026. According to the notices, port operator Asyaport Liman AŞ and Anadolu Planet Elektronik Tic. A.Ş., which runs the online store elevti.com, both suffered breaches that originated at third-party suppliers. The notices were published under Article 12(5) of Law No. 6698 on the Protection of Personal Data, by decisions of the Personal Data Protection Board.

What happened at Asyaport

According to KVKK's notice, the breach began on October 12, 2026 and was detected on October 19, 2026. Attackers exploited a security vulnerability in the Service Desk application of a supplier, bypassed authentication controls and changed the passwords of multiple accounts, gaining unauthorized access to them. As a result, documents belonging to the data controller were exposed, the notice says.

The affected data categories are identity data (name and surname) and contact data (email address and phone number). KVKK said 855 people, including employees, users and customers, had been identified at the initial stage, and that the investigation is ongoing. The notice does not describe what measures the company has taken.

What happened at elevti.com

The second notice concerns Anadolu Planet Elektronik Tic. A.Ş. According to KVKK, a data processor informed the company on September 10, 2026 that a data security incident had occurred in the systems of a company providing e-commerce infrastructure services. The notice does not give the start date of the breach or technical details of how it happened.

The exposed data includes names, phone numbers, email addresses, postal addresses and hashed passwords. KVKK said 592 end customers and 4 admin panel account users, 596 people in total, were affected. The notice states that the investigation is continuing.

Who is affected

The Asyaport incident affects employees, users and customers whose names and contact details were in the exposed documents. The elevti.com incident affects the online store's customers and a small number of administrative users. In both cases the breach originated at a supplier rather than in the data controllers' own systems, according to the notices.

What to do

People who may be affected should be wary of emails, text messages and calls that appear to come from these companies, as exposed contact details are often reused in phishing. Although the elevti.com passwords were hashed, customers who reused the same password on other services should change it there. Organizations should also review the access controls and authentication of supplier-run applications such as help desk tools, which were the entry point in the Asyaport case. According to the notices, affected individuals can contact Asyaport at [email protected] and elevti.com at [email protected].