KVKK: Shaya Mağazacılık reports 2,298,726 people affected by breach
A breach notice published by KVKK says 2,298,726 employees and customers were affected. The Authority’s examination is ongoing.
The Personal Data Protection Authority (KVKK) published the data breach notification submitted to the Board by Shaya Mağazacılık A.Ş., following Board decision No. 2026/2039 dated 16 September 2026. The Authority said its examination of the matter remains ongoing.
Unauthorized access and detection date
According to Shaya Mağazacılık’s submission to the Board, the breach resulted from unauthorized access to the data processor’s systems holding Shaya Mağazacılık data. The notification says the breach was identified when the processor notified Shaya Mağazacılık on 10 September 2026.
People and data types affected
The company’s notification lists the affected data as name, surname, email address and address information. It reports 2,298,726 affected people and identifies employees and customers as the affected groups.
EvilTokens infrastructure disrupted; Microsoft reports 12,000-plus compromised inboxes
Microsoft says it worked with partners to disrupt EvilTokens infrastructure. Its research links the service to BEC campaigns that compromised more than 12,000 inboxes at over 10,000 organizations.
Read publication
Check Point reports active exploitation of CVE-2026-85102 and CVE-2026-93616
Check Point reported active exploitation of flaws affecting Security Gateway and Security Management. CISA added both CVEs to its KEV Catalog, and fixes are available.
Read publication