Short answer
On 4 November 2026 Turkey's data protection authority KVKK published breach notices from Vava Cars Turkey Otomotiv and KVK Teknik Servis. Each says cyber attackers gained unauthorised access to customer chat files stored at a data processor: 8,268 records for Vava Cars and 624 for KVK Teknik Servis.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Vava Cars Turkey and KVK Teknik Servis |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by authorities |
| Sector | Used-car retail and technical service |
| Country | Turkey |
| Disclosed | 2026-11-04 |
| People or records affected | 8,268 chat records (Vava Cars) and 624 chat records (KVK Teknik Servis); number of people not yet determined |
What data was exposed
- Vava Cars: names, phone numbers, vehicle licence plates and appointment details (limited sample), plus message content, attachments and metadata under review
- KVK Teknik Servis: WhatsApp profile names and phone numbers
What happened
On Wednesday 4 November 2026, Turkey’s Personal Data Protection Authority (KVKK) published a series of breach notices after its board decided to make them public. Two of them describe the same pattern. Vava Cars Turkey Otomotiv A.S. and KVK Teknik Servis Hiz. ve Tic. A.S. each told KVKK that cyber attackers gained unauthorised access to customer chat files held by a data processor. The Turkish outlet LOG reported on the Vava Cars notice on 5 November.
Vava Cars
Vava Cars says the processor reported 8,268 chat records involved. The affected people are customers and potential customers. A limited sample review showed names, surnames, phone numbers, vehicle licence plates and appointment information. The records may also hold message content, attachments and metadata, and that review is still under way. The company says its investigation is continuing and points affected people to its website and call centre.
KVK Teknik Servis
KVK Teknik Servis says 624 chat records stored at its processor were affected. The data it lists is WhatsApp profile names and phone numbers. It gives an email address for affected people, musteridestek@kvkteknikservis.com. The notice does not state when the attack started or when it was detected.
What is not known
Neither notice says how many individuals are affected, who the attackers are or how they got in. Both give the same board decision number, and both describe an external processor, but KVKK has not said the two cases share a provider. A separate KVKK notice the same day concerns Hepsiburada, which ShiftDelete reports involved its chat provider’s infrastructure; that article says it does not establish any link to Vava Cars or KVK Teknik Servis, and neither do we.
Why chat data is useful to scammers
Chat logs show who bought or serviced what, and when. A message that quotes your car’s plate and a real appointment time looks like it came from the dealer. Expect fake rescheduling links, payment requests and calls that mention vehicle details.
What to do
Check suspicious contact through the company’s official site or phone number. Do not click links or give verification codes. If you want to know whether your chats were involved, write to the contact points above.
KVKK’s own rules require a company to notify it of a breach, and the authority can publish notices when it sees fit. See also the Dermojet data breach and the Izmir municipality email breach, earlier KVKK notices. Our data breach checklist and guide to phishing messages cover next steps.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Texts, WhatsApp messages or calls that mention your car, licence plate or service appointment to look like a real dealer or workshop.
- Phishing links disguised as appointment changes, payment requests or delivery notices.
- Spam and fake offers sent to the phone numbers exposed in the chats.
What to do if you are affected
- 01Be wary of any message or call that refers to a vehicle, plate or appointment and asks for payment or a code, and check it with the company on its official site or call centre.
- 02Contact the company through the channels in its KVKK notice to ask whether your chats were involved: its website and call centre for Vava Cars, musteridestek@kvkteknikservis.com for KVK Teknik Servis.
- 03Do not click links in unexpected WhatsApp or SMS messages, and never share verification codes.
- 04Review what you sent in any customer chat with these companies, such as photos or documents, and treat those as exposed.
- 05You can use your rights under the KVKK law to ask a company what data it holds about you, or complain to KVKK.
Frequently asked questions
How many people were affected?
KVKK notices say the number of affected people has not yet been determined. The data processors reported 8,268 chat records for Vava Cars and 624 for KVK Teknik Servis.
Did the two companies use the same provider?
The notices do not say so. Both describe unauthorised access to chat files at a data processor and were published on the same day under the same board decision number, but KVKK has not linked them and we cannot confirm a shared provider.
What data was exposed?
Vava Cars says a limited sample showed names, phone numbers, licence plates and appointment information, with message content, attachments and metadata still under review. KVK Teknik Servis lists WhatsApp profile names and phone numbers.
Were bank or payment details mentioned?
Neither notice lists payment card or bank data. The Vava Cars review of the chat records is ongoing, so treat anything you typed into a chat as possibly exposed.
Sources
- Kamuoyu Duyurusu (Veri Ihlali Bildirimi): Vava Cars Turkey Otomotiv A.S., KVKK (Turkish Personal Data Protection Authority), 2026-11-04
- Kamuoyu Duyurusu (Veri Ihlali Bildirimi): KVK Teknik Servis Hiz. ve Tic. A.S., KVKK (Turkish Personal Data Protection Authority), 2026-11-04
- KVKK, Vava Cars icin veri ihlal bildirimi gecti, LOG, 2026-11-05
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.