Baydöner March 2026 Data Incident
The March 2026 Baydöner data incident concerns publication of a customer-account dataset containing 1,266,822 unique emails. March 8 is a publication or catalogue date; it is not proven as the first-access or company-discovery date. No person-level dataset is locally available.
Exposed Data Types
9- Dates of birth
- Email addresses
- Genders
- Geographic locations
- Government-issued IDs
- Names
- Plaintext passwords in the corpus
- Phone numbers
- Purchase information
About This Breach
The nine classes are dates of birth, emails, genders, geographic locations, government-issued IDs, names, passwords present as plaintext, phones, and purchase information. Plaintext describes the dataset representation; it does not by itself prove how passwords were stored in production. Government IDs and dates of birth are reported only for a small subset. Payment cards, bank accounts, and payment infrastructure are excluded.
A record does not establish identity, a Baydöner account, an order, purchase, or campaign relationship, ownership of an ID, birth date, location, or phone, field co-occurrence, or misuse. If the plaintext password genuinely belonged to the person and was reused elsewhere, it should be replaced; refund, delivery, campaign, and identity-verification messages should be verified through an independent official channel.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
