Short answer
Turkey's data protection authority (KVKK) published a notice on 21 October 2026 saying ransomware had encrypted the database of DNC Sağlık Hizmetleri, a private health provider in Çankaya, Ankara. Staff found a Turkish ransom note on a server screen. The number of people affected is not yet known.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | DNC Sağlık Hizmetleri A.Ş. |
|---|---|
| Incident type | Ransomware |
| Status | Confirmed by authorities |
| Sector | Healthcare |
| Country | Turkey |
| Disclosed | 2026-10-21 |
| People or records affected | Not yet determined because the database was encrypted. Patients, relatives, staff and business partners are covered. |
What data was exposed
- Name, surname and T.C. identification number
- Phone number, address and email address
- Examination, lab, imaging, diagnosis, prescription and treatment history records
- Appointment, billing and SGK or private insurance authorization records
What happened
According to the Personal Data Protection Authority’s public notice, staff at DNC Sağlık Hizmetleri, a private health provider in Çankaya, Ankara, saw a ransom note written in Turkish on a server screen. They then found they could not open the database files. The Board ordered the notice published on 21 October 2026 (decision 2026/2282).
The notice says October 2026 but gives no day, so we have left the discovery date blank.
What was in the database
The encrypted server held records on patients, relatives, staff and business partners. KVKK lists identity data including the T.C. identification number, contact details, health records (examinations, lab and imaging, diagnoses, prescriptions and treatment history) and financial records such as appointments, billing and SGK or private insurance authorizations. Health data is a special category under Turkish law.
What the notice leaves out
The notice gives no number of people, no explanation of how the attackers got in, and no description of what DNC has done in response. Because the files were encrypted, the company could not say at the first stage who was affected. Encryption alone does not prove data was copied, but many ransomware groups steal files first.
A summary of the same KVKK batch lists DNC among 10 notices released that day.
What patients can do
If you were treated at a private clinic in Çankaya in recent months, ask the clinic directly whether your records were on the affected server. Clinics must tell affected people under Law No. 6698 once they know who is involved. Until then, assume the risk applies to you.
The main danger is a convincing scam. Someone who knows your diagnosis or prescription can pose as a clinic or insurer far more easily. Read our guides on phishing messages and government impersonation scams, and follow the data breach checklist. Health records are hard to change once exposed, which is why the first weeks matter. Keep any letters or messages from the clinic, and note the dates of calls you receive in case you need to show them to KVKK or the police later. We will update this page if DNC or KVKK publishes more. Related cases are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls pretending to be a clinic, SGK or your insurer, using your diagnosis or prescription to sound real and asking for payment or a verification code
- Fake 'unpaid treatment bill' or 'insurance refund' texts that link to a copied payment page
- Extortion emails that threaten to reveal health information. No leak has been reported, so do not pay or reply
- Identity fraud, because T.C. identification numbers are used for bank, e-Devlet and mobile-line applications
What to do if you are affected
- 01Be sceptical of any call or message that mentions your treatment or prescriptions. Hang up and call the clinic or insurer on a number you look up yourself.
- 02Never give an SMS code, e-Devlet password or card detail to a caller, even one who knows your T.C. number.
- 03Ask your bank and mobile operator to add extra checks on changes to your accounts or lines.
- 04Check your e-Devlet records and credit report for applications you did not make.
- 05Complain to KVKK if you think your data was mishandled (Alo 198, kvkk.gov.tr).
Frequently asked questions
Was my medical data stolen?
Not established. The notice says the database was encrypted by ransomware and could not be read. It does not say whether data was copied. Because the database held health records, treat the risk as serious.
How many patients are affected?
The number could not be determined at the first stage, because the encrypted database could not be inspected. The group covers patients, their relatives, staff and business partners.
What medical data was in the database?
According to KVKK, it held examination, lab, imaging, diagnosis, prescription and treatment history records, along with identity, contact and billing data.
When did the attack happen?
The notice says October 2026, when staff saw a ransom note on a server screen, but it gives no exact day.
Has DNC said anything?
We found no separate statement from the company. The KVKK page lists no remediation steps and no contact details for DNC.
Sources
- Kamuoyu Duyurusu (Veri İhlali Bildirimi): DNC Sağlık Hizmetleri A.Ş. (Public Notice, Data Breach Notification: DNC Health Services), KVKK (Turkish Personal Data Protection Authority), 2026-10-21
- KVKK 10 veri ihlalini duyurdu: Belediye ve üniversite de listede (KVKK announced 10 data breaches: a municipality and a university are on the list), Memurlar.Net via Bundle, 2026-10-22
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.