Short answer
On 21 October 2026 Turkey's data protection authority (KVKK) published a notice saying an outside party reached a server in Dermojet's data processing systems by exploiting a flaw in a third-party software library. The notice puts the number of affected customers and prospects at 50,636. The investigation is ongoing.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Dermojet Sağlık Ürünleri Sanayi ve Ticaret A.Ş. |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by authorities |
| Sector | Health and skincare retail |
| Country | Turkey |
| Detected | 2026-09-10 |
| Disclosed | 2026-10-21 |
| People or records affected | 50,636 customers and prospective customers, per the KVKK notice |
What data was exposed
- Full names
- Phone numbers
- Email addresses
- Postal addresses
- Hashed passwords and login credentials
What happened
Dermojet, a Turkish health and skincare products company, reported a data breach to the Personal Data Protection Authority (KVKK). The authority published the notice on 21 October 2026. It says an unauthorized party got into a server in the data processing systems by exploiting a security flaw in a third-party software library.
Timeline
The data processor told Dermojet about the incident on 10 September 2026, according to the notice. That is six weeks before the public announcement. KVKK’s Board decided on 21 October to publish the notice, and the review is still open.
Who is affected
The notice counts 50,636 people. They are customers and prospective customers. The exposed data is full name, phone number, email address, postal address and hashed passwords or login credentials.
Part of a larger KVKK batch
Dermojet was one of 10 notices KVKK released that day. A Memurlar.Net summary says Dermojet used the same attack method as Güllüoğlu and Kurukahveci Mehmet Efendi. We cover the first of those in a separate post, Güllüoğlu. Neither the notice nor the summary names the processor or the software library.
What the company has said
The notice gives contact channels for affected people: info@dermojet.com.tr, (0530) 738 29 87 and dermojet.com.tr. We found no separate customer email or press statement from Dermojet, and the notice does not describe containment steps.
What is still unknown
The notice does not say how the passwords were hashed, which matters for how easily they can be cracked. It does not say whether the data has been published or sold. It also does not say whether Dermojet customers outside Turkey are included.
What this means for you
A name, phone number and address are enough for a convincing fake message. Scammers often pose as a shop with a parcel problem or a refund. Our guides on online shopping scams and phishing messages show how these look, and the data breach checklist lists the first steps. More incidents are on the breaches index.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake order, delivery or discount messages by SMS or WhatsApp sent to the phone number you gave the shop, linking to a copied payment page
- Phishing emails saying your Dermojet account is locked and asking you to 'confirm' your password
- Credential stuffing: attackers trying your email and password combination on other shops, email and bank apps
- Calls from people who know your name and address and pose as the shop, a courier or a bank
What to do if you are affected
- 01Change your Dermojet password, and change it on every other site where you used the same one.
- 02Use a unique password for each shop and turn on two-factor authentication for your email account.
- 03Treat unexpected messages about orders, parcels or refunds as suspect. Type the shop's address yourself instead of tapping a link.
- 04Never share SMS codes or full card details with a caller or chat contact. Banks do not ask for them.
- 05Ask Dermojet about the incident at info@dermojet.com.tr or (0530) 738 29 87, and complain to KVKK if you think your data was mishandled (Alo 198).
Frequently asked questions
How many Dermojet customers were affected?
The KVKK notice gives 50,636 people, described as customers and prospective customers. The investigation is ongoing, so the figure could change.
Were my passwords exposed?
The notice lists hashed passwords and login credentials among the affected data. Hashing makes passwords harder to read, but weak or reused ones can still be guessed, so change yours.
When did Dermojet find out?
According to the notice, the data processor told Dermojet on 10 September 2026. KVKK's Board ordered the public notice on 21 October 2026 under decision 2026/2281.
Were card details taken?
Card details are not in the list of affected data in the KVKK notice.
Is this linked to the Güllüoğlu and Mehmet Efendi breaches?
The Memurlar.Net summary says all three describe the same method, a flaw in a third-party software library. KVKK has not said they were one attack or one processor.
Sources
- Kamuoyu Duyurusu (Veri İhlali Bildirimi): Dermojet Sağlık Ürünleri Sanayi ve Ticaret Anonim Şirketi (Public Notice, Data Breach Notification: Dermojet), KVKK (Turkish Personal Data Protection Authority), 2026-10-21
- KVKK 10 veri ihlalini duyurdu: Belediye ve üniversite de listede (KVKK announced 10 data breaches: a municipality and a university are on the list), Memurlar.Net via Bundle, 2026-10-22
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.