KVKK notices: ransomware hits Enka foundation, MW Phokaia resort reports email intrusion

Turkey's Personal Data Protection Authority (KVKK), the national data protection regulator, published two more breach notifications on October 21, 2026. According to the notices, the Enka Sports, Education and Social Aid Foundation was hit by a ransomware attack that affected passport copies of teachers and students, while Akropol Turizm, operator of MW Phokaia Beach & Resort, reported cyber incidents involving its IT systems and corporate email accounts. In both cases the number of affected people has not yet been determined.

The notices were published under Article 12/5 of Turkey's Personal Data Protection Law No. 6698, following decisions of the Personal Data Protection Board dated October 21, 2026.

What happened

Enka Foundation: According to KVKK, the foundation's server infrastructure was targeted by a ransomware attack. The notice says the technical investigation into how the attacker gained access and the full scope of affected systems is still ongoing. The dates on which the breach occurred and was detected are not given.

MW Phokaia Beach & Resort: KVKK's notice states that cyber security incidents occurred involving the IT infrastructure and corporate email accounts of the facility operated by Akropol Turizm. Corporate accounts suspected of unauthorized access are being examined, and the notice says a possible transfer of data is also being investigated. The start and end dates of the breach have not yet been determined.

Who is affected

According to the Enka notice, affected groups include employees, students, alumni and children. The data involved consists of:

• identity details found in passport copies of teachers, students and alumni, including full name, date and place of birth, nationality, passport number and photo;
• event photos and passport photos archived on the server.

The number of affected people and records is not known at this stage.

For MW Phokaia, KVKK says the following categories may be affected while the investigation continues: identity and contact details, personal information within corporate email correspondence, reservation and accommodation data, employee personnel and contact information, and financial or transaction information of individuals. Potentially affected groups include employees, guests, suppliers and representatives of business partners. No count of affected people is given.

What to do

Parents, students, alumni and staff connected to the Enka foundation should be alert to identity fraud attempts that could use passport details and photos, and contact the foundation for information. Guests who stayed at or corresponded with MW Phokaia Beach & Resort should be cautious of emails that appear to come from the hotel, especially those asking for payment, card details or reservation changes, since compromised corporate mailboxes are commonly used for invoice and booking fraud. Verifying such requests through a known phone number is advisable.

Neither notice describes the measures the organizations have taken, and both say the investigations are ongoing.