Short answer
Turkey's Personal Data Protection Authority (KVKK) announced on 7 October 2026 that ransomware had hit the virtualization infrastructure of Yıldız Technical University in Istanbul. About 140,000 students and 4,500 staff may be affected. The university says its logs show no data left its network, but the data categories at risk have not been published.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Yıldız Technical University (YTÜ) |
|---|---|
| Incident type | Ransomware |
| Status | Confirmed by authorities |
| Sector | Education |
| Country | Turkey |
| Detected | 2026-10-01 |
| Disclosed | 2026-10-07 |
| People or records affected | About 140,000 students and 4,500 staff possibly affected, plus an unknown number of visitors (figures from the KVKK notice) |
What data was exposed
- Categories of personal data not yet determined by the university
- Student and staff records held on the affected virtual servers (possible)
What happened
Yıldız Technical University (YTÜ), one of Istanbul’s best-known engineering schools, lost access to much of its online infrastructure on 1 October 2026, at the start of the academic year. For several days the website, the Student Information System (OBS) and the Online Yıldız teaching platform were unreachable. According to Sözcü, university management first described the outage as “technical work” and did not mention a cyberattack until the regulator went public.
What the regulator said
On 7 October the Personal Data Protection Board published a public notice under decision 2026/2203. It says the breach began and was detected on 1 October, and that ransomware hit the university’s virtualization infrastructure and the servers running on it. The notice does not say whether data was copied, and it gives no list of data categories.
The university’s account
In a statement reported by Euronews Türkçe, the university said it filed the breach notice itself on 6 October. It said nine days of work with a Turkish data recovery firm found no traffic suggesting data had been moved out. The traffic logs are kept on servers run by ULAKBİM, the national academic network, not on campus.
The university also said no data was lost, that about 500 TB was scanned and tested during recovery, and that 95 percent of systems were running again. Systems became partly available on 5 October. It added that its statement about data not leaving the network was missing from the KVKK page, which it said gave a misleading impression. A full public statement is promised after the forensic work ends.
What is still unknown
- Which categories of personal data sat on the affected servers.
- Whether attackers copied anything before encrypting it. A “no evidence” finding from logs is not the same as proof.
- Whether a ransom was demanded, and which group is responsible. No group has been named in the reports we read.
If you studied or worked at YTÜ, the practical risk is phishing that uses real university details. Our guides on phishing messages and government impersonation scams describe the common tricks, and the data breach checklist lists the steps in order. More incidents are collected on our breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake messages that claim to come from the university's student affairs office and ask you to log in to a copied portal to 'restore' your account
- Phone calls or WhatsApp messages from people posing as university IT staff, KVKK or the police who ask for your student number, e-Devlet password or an SMS code
- Scholarship, tuition-refund or dormitory-fee scams that use real student details to sound credible
- Extortion emails that claim to hold your records. The university says it has seen no evidence of leaked data, so treat such demands as unverified
What to do if you are affected
- 01Change your university account password and any password you reused elsewhere. Turn on two-factor authentication where it is offered.
- 02Only sign in through the official YTÜ address you type yourself. Do not follow links in emails or messages that mention the attack.
- 03Never give an SMS code, e-Devlet password or bank card detail to anyone who calls about the incident. The university and KVKK do not ask for these.
- 04Watch for the university's formal notice to affected people and for the forensic report it has promised.
- 05If your data is misused, you can file a complaint with KVKK through its website or the Alo 198 line, and report phishing sites to USOM.
Frequently asked questions
Was my data stolen in the Yıldız Technical University attack?
That is not yet established. KVKK says only that ransomware hit the university's servers and that data categories are still being identified. The university told Euronews Türkçe that its traffic logs showed no sign of data leaving the network, and Euronews found no evidence of a leak online.
How many people are affected?
KVKK lists about 140,000 students and 4,500 staff as possibly affected. The number of visitors could not be determined. One interview gives the staff figure as more than 4,000, so treat the figures as estimates.
Did the university pay a ransom?
No source we opened says so. As of 8 October the university had not said whether it received a ransom demand.
What should students do now?
Change your password, ignore unexpected messages about the incident and keep an eye on the university's official announcements. See our guide on what to do after a data breach.
How do I complain to KVKK?
You can submit a complaint through the KVKK website or call its Alo 198 hotline. The authority's address is Nasuh Akar Mahallesi 1407. Sok. No:4, Çankaya, Ankara.
Sources
- Kamuoyu Duyurusu (Veri İhlali Bildirimi): Yıldız Teknik Üniversitesi (Public Notice, Data Breach Notification: Yıldız Technical University), KVKK (Turkish Personal Data Protection Authority), 2026-10-07
- Yıldız Teknik Üniversitesi, Euronews Türkçe'ye açıkladı: Siber saldırı krizinde KVKK eksik bilgi mi verdi? (Yıldız Technical University tells Euronews Türkçe: did KVKK give incomplete information in the cyberattack crisis?), Euronews Türkçe, 2026-10-10
- Yıldız Teknik Üniversitesi'nde 140 bin öğrencinin verisi tehlikede (Data of 140,000 students at Yıldız Technical University at risk), Sözcü, 2026-10-08
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.