KVKK publishes three new breach notices: Gür Grup, Monnalisa and Barrels and Oil

Turkey's Personal Data Protection Authority (KVKK), the country's data protection regulator, published three new data breach notices on October 7, 2026 involving construction company Gür Grup İnşaat, babywear manufacturer Monnalisa Bebek Giyim and Hüşyar Tekstil, the operator of the online clothing store barrelsandoil.com. The notices were published under Article 12(5) of Law No. 6698 on the Protection of Personal Data, which requires the authority to be notified when personal data is obtained unlawfully by others. In all three cases, the companies said they could not yet determine how many people were affected.

Gür Grup İnşaat

According to KVKK's notice, the breach at Gür Grup İnşaat San. ve Tic. A.Ş. began on October 3, 2026 and was detected the same day. The company reported that its systems were accessed from outside, after which data was encrypted and locked and access was closed. The notice does not describe the attack method further.

The affected groups are employees and users. The data categories involved are location data, personnel records and visual and audio recordings. KVKK said the company could not estimate the number of people affected and that the investigation is ongoing. The authority's board ordered publication with decision No. 2026/2214.

Monnalisa Bebek Giyim

Monnalisa Bebek Giyim San ve Tic A.Ş. attributed its breach to a ransomware attack, according to KVKK. The incident began on September 28, 2026, ended on September 29 and was detected on September 29. The method used by the attackers and the vulnerability exploited have not been determined, and a technical investigation is continuing.

Because the attackers encrypted the company's files, the controller could not determine how many people were affected. The notice states that the affected data subject groups and data categories were not specified. Publication was ordered with board decision No. 2026/2210.

Hüşyar Tekstil (Barrels and Oil)

KVKK's notice says unauthorized parties accessed a server holding data of Hüşyar Tekstil Paz. İth. İhr. San. Tic. Ltd. Şti. by exploiting a vulnerability in a third-party software library used by its systems. The breach was identified on September 29, 2026 after a notification from the company's data processor.

For store customers, exposed data includes first and last names, postal addresses, email addresses, phone numbers and stored password values. Admin panel user accounts and their stored password values were also affected. The affected groups are users, subscribers or members, and customers or potential customers. The number of people has not been determined, and the investigation is ongoing. Publication was ordered with decision No. 2026/2213.

What to do

Barrels and Oil customers should change their password on the site and on any other service where they reused it, and be wary of phishing emails, calls or text messages that reference their orders. The company has provided [email protected] for questions about the breach. Employees and customers of Gür Grup and Monnalisa should watch for official communications from the companies and treat unexpected requests for personal or financial information with caution.