Short answer
On 21 October 2026 Turkey's data protection authority (KVKK) published a notice saying an outside party reached a server run by a Güllüoğlu service provider. The data of 67,193 people was affected, including names, phone numbers, emails, addresses and stored passwords. The company learned of it on 8 October.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Güllüoğlu Gıda San. ve Tic. A.Ş. |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by authorities |
| Sector | Food retail |
| Country | Turkey |
| Detected | 2026-10-08 |
| Disclosed | 2026-10-21 |
| People or records affected | 67,193 people, per the KVKK notice |
What data was exposed
- Names
- Phone numbers
- Email addresses
- Postal addresses
- Stored password values (the notice does not say how they were protected)
- Seller panel account details and stored password values
What happened
Güllüoğlu, the Istanbul baklava maker, told the Personal Data Protection Authority (KVKK) that an outside party had reached a server belonging to one of its data processors. The processor flagged the problem to the company on 8 October 2026. KVKK’s Board ordered the public notice on 21 October under decision 2026/2281.
The cause, as stated
The notice says the intruder exploited a security flaw in a third-party software library running on the processor’s server. That means the weakness sat in a supplier’s system rather than in anything customers did. The notice does not name the library or the processor.
Who is affected
KVKK lists 67,193 users. Shop customers lost names, phone numbers, email addresses, postal addresses and stored password values. Accounts on the seller panel, used by staff to run the online store, also had user details and stored password values exposed.
What the company has said
Güllüoğlu’s contact details for affected people are in the notice: a call centre on 0212 225 52 82 and info@karakoygulluoglu.com. The notice does not describe any containment steps, and we found no separate customer email or press statement from the company. The investigation is still open.
Same pattern elsewhere
The notice appeared in a batch of 10 that KVKK released the same day, summarised by Memurlar.Net. Two other companies in the batch, Kurukahveci Mehmet Efendi and Dermojet, describe the same flaw type. Details of the processor behind them are not public.
What to watch for
The notice does not say how the stored passwords were protected. If they were hashed well, they are hard to read. If not, anyone holding the data could try them on other sites. That is why changing reused passwords matters more than the shop account itself. Many people use one password for the shop, their email and sometimes a banking app.
With a name, phone number and address, a scammer can write a message that looks like a real order update. Our guides on online shopping scams and phishing messages show how these look, and the data breach checklist covers the first steps. See also the breaches index.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake order, delivery or refund messages sent by SMS or WhatsApp to the phone number you gave Güllüoğlu, linking to a copied payment page
- Credential stuffing: attackers trying your leaked email and password on other shops, email and bank apps
- Calls from people who know your name and address and pretend to be the shop, a courier or a bank
- Phishing emails that claim your Güllüoğlu account is locked and ask you to 'verify' your password
What to do if you are affected
- 01Change your Güllüoğlu password now, and change it on every site where you used the same one.
- 02Use a unique password for each shop and turn on two-factor authentication for your email.
- 03Treat any unexpected message about an order, parcel or refund as suspect. Open the shop's official site by typing the address yourself.
- 04Never share SMS codes or full card details by phone or chat. Banks do not ask for them.
- 05Contact the company via the notice's channels (call centre 0212 225 52 82 or info@karakoygulluoglu.com), and complain to KVKK if you think your data was mishandled (Alo 198).
Frequently asked questions
How many Güllüoğlu customers were affected?
The KVKK notice gives 67,193 people, all described as users. The authority's investigation is ongoing, so the figure may change.
Were my passwords exposed?
The notice says stored password values were affected, for both shop customers and seller panel accounts. It does not say how they were protected, so change your password and any matching ones elsewhere.
Were card details taken?
Card details do not appear in the list of affected data in the KVKK notice.
How did attackers get in?
According to the notice, an unauthorized party reached a server in a data processor's systems by exploiting a security flaw in a third-party software library. Güllüoğlu learned of this on 8 October when the processor reported it.
Is this linked to other Turkish breaches this month?
The same KVKK batch describes the same method (a flaw in a third-party library on a processor's server) at Kurukahveci Mehmet Efendi and Dermojet. KVKK has not said they were a single attack.
Sources
- Kamuoyu Duyurusu (Veri İhlali Bildirimi): Güllüoğlu Gıda San. ve Tic. A.Ş. (Public Notice, Data Breach Notification: Güllüoğlu Gıda), KVKK (Turkish Personal Data Protection Authority), 2026-10-21
- KVKK 10 veri ihlalini duyurdu: Belediye ve üniversite de listede (KVKK announced 10 data breaches: a municipality and a university are on the list), Memurlar.Net via Bundle, 2026-10-22
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.