Short answer
Turkey's data protection authority (KVKK) published a notice on 21 October 2026 saying an attacker reached a server run by a processor for coffee brand Kurukahveci Mehmet Efendi. Up to 15,303 customers and 18 admin panel accounts were affected, and the breach was confirmed on 7 October after the processor notified the company.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Kurukahveci Mehmet Efendi Mahdumları Gıda Sanayi ve Ticaret A.Ş. |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by authorities |
| Sector | Food retail |
| Country | Turkey |
| Detected | 2026-10-07 |
| Disclosed | 2026-10-21 |
| People or records affected | Up to 15,303 customers and 18 admin panel accounts, per the KVKK notice |
What data was exposed
- Names
- Phone numbers
- Email addresses
- Address information
- Hashed customer passwords
- Admin panel account details and hashed passwords
What happened
On 7 October 2026 Kurukahveci Mehmet Efendi, one of Turkey’s best-known coffee brands, was notified by a data processor that an attacker had gained access to a server in the processor’s systems, and the breach was confirmed that day. The Personal Data Protection Board ordered the public notice on 21 October (decision 2026/2281). The investigation is ongoing.
What the notice says
The attacker exploited a security flaw in a third-party software library used by the processor’s systems. The data affected belongs to the brand’s online store: customer names, phone numbers, email addresses and address information, plus hashed passwords. Accounts that run the store’s admin panel were also touched, with their details and hashed passwords.
KVKK counts up to 15,303 end customers and 18 admin panel users. The notice groups them as employees and customers or potential customers.
A similar notice for another company
KVKK published a notice for Dermojet the same day. It describes the same method: access to a server in a processor’s systems through a flaw in a third-party software library. The notices do not name the processor or the library, and KVKK has not said whether one attack lies behind both.
Why hashed passwords still matter
A hash is a scrambled form of a password. Strong, long passwords are hard to recover from a hash. Short or common ones, such as names with birth years, can often be guessed quickly by software. If yours was simple, assume it could be recovered. Change it, and change any other account that used the same one, starting with your email.
What is not known
- Whether the data has been sold or published.
- Which processor and which software library were involved.
- What the company has changed since, because the notice lists no remediation steps.
We found no separate customer email or press statement from the company. If you ordered online, expect scam texts and calls that use your name. Read our guides on online shopping scams and phishing messages, then follow the data breach checklist. More cases sit on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake order, delivery or discount messages to your phone number or email, pointing to a lookalike coffee-shop payment page
- Phone calls using your name and address to pose as the brand, a courier or your bank
- Password-reuse attacks. Hashed passwords are harder to use than plain ones, but weak passwords can still be guessed
- Fake 'your account was breached, confirm your details' emails that borrow the real KVKK notice
What to do if you are affected
- 01Change your Mehmet Efendi password and any other site where you used it. Choose a long, unique one.
- 02Open the shop only by typing the address yourself. Ignore links in messages about orders you do not remember.
- 03Do not give out SMS codes or card numbers to callers, even if they know your address.
- 04Contact the company at the address given in the notice, kvkk@mehmetefendi.com, if you need details about your own data.
- 05If you think your data was mishandled, file a complaint with KVKK (Alo 198).
Frequently asked questions
How many Mehmet Efendi customers were affected?
KVKK says at most 15,303 end customers and 18 admin panel account holders. The exact number may be lower, and the investigation is continuing.
Were my passwords leaked?
The notice says hashed passwords were affected for both customers and admin users. Hashing scrambles passwords, but weak ones can still be cracked, so change yours.
How did the attackers get in?
The notice says an unauthorized party reached a server in a data processor's systems by exploiting a flaw in a third-party software library. The processor notified the company, and the breach was confirmed on 7 October.
Were bank card details exposed?
Card data is not in the list of affected categories in the KVKK notice.
Who do I contact about my data?
The notice gives kvkk@mehmetefendi.com for questions from affected people. You can also complain to KVKK.
Sources
- Kamuoyu Duyurusu (Veri İhlali Bildirimi): Kurukahveci Mehmet Efendi Mahdumları Gıda Sanayi ve Ticaret A.Ş. (Public Notice, Data Breach Notification), KVKK (Turkish Personal Data Protection Authority), 2026-10-21
- Kamuoyu Duyurusu (Veri İhlali Bildirimi): Dermojet Sağlık Ürünleri Sanayi ve Ticaret A.Ş. (Public Notice, Data Breach Notification), KVKK (Turkish Personal Data Protection Authority), 2026-10-21
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.