Short answer
Turkey's data protection authority (KVKK) said on 21 October 2026 that attackers used a previously compromised password to take over two İzmir municipality email accounts. They copied the mailbox contents, sent bulk spam and added fraud-related text to email signatures. The number of people affected has not been determined.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | İzmir Büyükşehir Belediyesi (İzmir Metropolitan Municipality) |
|---|---|
| Incident type | Account takeover |
| Status | Confirmed by authorities |
| Sector | Local government |
| Country | Turkey |
| Detected | 2026-09-30 |
| Disclosed | 2026-10-21 |
| People or records affected | Not yet determined, according to the KVKK notice |
What data was exposed
- First and last names
- Email addresses
- Internal phone numbers
- Contents of two municipal mailboxes (the notice does not list what the messages contained)
What happened
The İzmir Metropolitan Municipality reported an email account breach to Turkey’s Personal Data Protection Authority (KVKK). The authority published the notice on 21 October 2026. According to the notice, the municipality noticed an unusually large volume of email leaving a corporate account on 30 September 2026.
How the attackers got in
KVKK’s notice says the intruders used a password that had been compromised earlier. It states that the cause was not a weakness in the email server itself. In plain terms, a stolen or leaked password still worked.
What they did with the access
The notice lists several actions. The contents of two mailboxes were copied out of the institution. A rule was created to delete incoming messages, which can hide a takeover from the account owner. Bulk spam went out from the account. Existing correspondence was opened, mail settings were changed, and fraud-related text was added to email signatures.
What data was involved
The only data categories named are first name, last name, email address and internal phone number. The notice also says the mailbox contents were taken, but it does not describe what those messages held. The number of people affected has not been fully determined.
Context
The notice was one of 10 that KVKK released on the same day, according to a Memurlar.Net summary. Most of the others involve companies. This one is a local government account takeover, a different kind of incident from the software-library flaw in the Güllüoğlu case, which we cover in a separate post.
What is still unknown
The municipality’s own response is not in the notice, and we did not find a separate public statement from it. We do not know whose messages were in the two mailboxes, whether residents or contractors are among them, or whether the copied data has been published. The investigation is ongoing.
Why it matters for residents and suppliers
Mail sent from a real municipal address is far more believable than a spoof. Scammers who read old threads can reply with accurate details about a permit, contract or invoice. Our guides on phishing messages and urgent payment scams explain the pressure tactics, and the data breach checklist covers the basic steps. More incidents are on the breaches index.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Convincing fake emails from a real municipal address, since attackers controlled genuine accounts and could reply inside existing threads
- Fake invoice, fine or payment-change requests that mention real contracts or projects
- Phishing links in messages that look like they come from municipal staff you have dealt with
- Fake calls using internal phone numbers and staff names to build trust
What to do if you are affected
- 01If you corresponded with İzmir municipality staff by email, treat any odd message from a municipal address as suspect until you confirm it by phone using a number from the official website.
- 02Do not change bank details or pay an invoice because of an email alone. Call the office on a number you look up yourself.
- 03Do not click links or open attachments in unexpected messages, even from a known sender.
- 04If you use the same password on other accounts, change it everywhere and turn on two-factor authentication for your email.
- 05Complain to KVKK if you think your data was mishandled (Alo 198).
Frequently asked questions
How did attackers get into İzmir municipality's email?
According to the KVKK notice, they used a password that had been compromised earlier. The notice says it was not caused by a flaw in the mail server.
What did the attackers do?
The notice says the contents of two mailboxes were transferred out, a rule was set to delete incoming mail, bulk spam was sent, mail settings were changed and fraud-related text was added to email signatures.
How many people are affected?
KVKK says the number of data subjects has not been fully determined. The investigation is ongoing.
When was it discovered?
The notice says the municipality noticed an unusually high volume of email from a corporate account on 30 September 2026. KVKK's Board ordered the public notice on 21 October under decision 2026/2271.
Did the municipality give a contact point for affected people?
The notice we read lists none for the municipality. It only gives KVKK's own contacts, including the Alo 198 line.
Sources
- Kamuoyu Duyurusu (Veri İhlali Bildirimi): İzmir Büyükşehir Belediyesi (Public Notice, Data Breach Notification: İzmir Metropolitan Municipality), KVKK (Turkish Personal Data Protection Authority), 2026-10-21
- KVKK 10 veri ihlalini duyurdu: Belediye ve üniversite de listede (KVKK announced 10 data breaches: a municipality and a university are on the list), Memurlar.Net via Bundle, 2026-10-22
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.