İzmir Metropolitan Municipality Corporate Email Data Breach
On September 30, 2026, İzmir Metropolitan Municipality (izmir.bel.tr) detected a security breach after observing an abnormal volume of outbound messages from a corporate email account.
The organization has not published how many were affected, so the incident cannot be placed on this scale.
Exposed Data Types
4- Names
- Email addresses
- Phone numbers
- Email messages
About This Breach
Forensic review determined that attackers accessed the accounts using previously compromised credentials rather than a mail server vulnerability, and Turkey's Personal Data Protection Board (KVKK) published the notice under Decision No. 2026/2271 on October 21, 2026.
Attackers exfiltrated the mailbox contents of two compromised accounts, configured rules to delete incoming messages, sent bulk spam, opened existing correspondence threads, and injected fraudulent text into email signatures. Exposed data included full names, email addresses, internal phone extensions, and email messages, while the exact number of affected individuals could not be immediately determined.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
