KVKK notices: İzmir municipality email takeover, Ondokuz Mayıs University and Choice Hotels

Turkey's Personal Data Protection Authority (KVKK), the country's data protection regulator, published new data breach notices on October 21, 2026 involving İzmir Metropolitan Municipality, Ondokuz Mayıs University in Samsun and US-based hotel franchisor Choice Hotels International. The notices were published under Article 12(5) of Law No. 6698 on the Protection of Personal Data, which requires data controllers to notify the authority and affected people when personal data is obtained unlawfully by others. KVKK says its review of all three incidents is continuing.

İzmir Metropolitan Municipality: stolen password used to hijack email accounts

According to KVKK's notice, İzmir Metropolitan Municipality noticed on September 30, 2026 that an unusually high volume of email was being sent from a corporate account. The notice states that the attacker did not exploit a flaw in the email server but logged in with a password that had been compromised earlier.

KVKK lists the activity seen on two accounts: exporting mailbox contents outside the organization, creating a rule that deleted incoming messages, sending bulk spam, changing message settings, accessing existing correspondence and adding fraudulent text to the email signature. The data involved includes names, email addresses and internal phone numbers. The exact number of affected people could not be determined. Publication was ordered with board decision No. 2026/2271.

Ondokuz Mayıs University: software vulnerability

KVKK says unauthorized access to Ondokuz Mayıs University systems was gained by exploiting a vulnerability in software used by the university. The breach was detected on October 14, 2026 following a notification from USOM, Turkey's national computer emergency response team. The notice puts the number of affected people at 109 and lists identity, contact and location data as the categories involved. The affected groups have not yet been identified, and the start date was not given. Publication was ordered with decision No. 2026/2290.

Choice Hotels: employee account compromised

According to KVKK, a threat actor used social engineering to gain unauthorized access to a Choice Hotels International employee's network account. The breach began on June 5, 2026, ended on June 6 and was detected on June 5 through an alert generated by the company's security monitoring controls. The affected group is customers, and the number of affected people is 9,550. Exposed data includes names and contact information, and for some customers, details of past hotel stays. Publication was ordered with decision No. 2026/2288.

What to do

People who corresponded with İzmir Metropolitan Municipality should be cautious with unexpected messages from municipal addresses, especially those asking for payments or containing unusual signature text, and verify requests through official channels. Choice Hotels customers should watch for phishing that references their bookings or stays. For organizations, the İzmir case shows why multi-factor authentication, monitoring for new mailbox forwarding and deletion rules, and alerts on abnormal sending volume matter even when no server vulnerability is involved.