Glossary term
Data breach
A data breach is an event where someone gets access to information they are not authorized to see, or where authorized users use it for a purpose they were not allowed.
Read more
Significant cyber incident
Attack and data leak claims about the e-Devlet gateway
In February 2023 and June 2026, claims that the e-Devlet gateway had been attacked or its user data leaked were rejected in official statements.
In short
In February 2023 and June 2026, claims that the e-Devlet gateway had been attacked or its user data leaked were rejected in official statements. The Digital Transformation Office said in 2023 that the login data came from attacks on individual users' devices through phishing and malware, not from a breach of the gateway. In June 2026 officials said temporary access problems came from high traffic.
What happened
On 25 February 2023, claims appeared that login details of e-Devlet gateway users had been leaked. On 26 February 2023 the Presidential Digital Transformation Office said on its Twitter account that the claims did not reflect reality, that inspections found no data breach in the e-Devlet infrastructure, and that the data allegedly came from attacks on individual users’ devices through phishing and malware. It recommended turning on two-factor authentication.
According to Sözcü, the statement added that passwords are never kept as plain text, that only hash values are compared at login, and that the system follows international information security standards.
On 10 June 2026, the Presidency Communications Directorate’s Disinformation Struggle Center (DMM) said that claims of a cyber attack on the e-Devlet gateway and of the system collapsing did not reflect reality. It said there had been no cyber attack, data security vulnerability or system failure, and that temporary access problems in some services came from high traffic and ongoing technical improvement work.
This was not the first such denial. Anadolu Agency reports an earlier statement from the same Digital Transformation Office, dated 13 April 2022, rejecting a data breach claim. It said the gateway does not store personal data such as population records, ID card images or health data, and that fake ID card images had been made by fake ID applications from publicly known information.
Timeline
-
13 April 2022
The Digital Transformation Office rejects an earlier data breach claim about the gateway, according to Anadolu Agency.
-
25 February 2023
Claims of leaked e-Devlet login details appear.
-
26 February 2023
The Presidential Digital Transformation Office rejects the claims and recommends two-factor authentication.
-
10 June 2026
The DMM rejects claims of an attack on the e-Devlet gateway and of a system collapse.
How the attack worked
The claim and the official account
The 2023 claim was that e-Devlet login data had leaked. The office’s account is that the gateway itself was not breached. It says the data was taken from users’ own devices by phishing and malware, aimed at individual users. On this account, the weak point was the device and the user, not the portal.
The 2026 claim
The June 2026 claim was about availability: an attack and a collapse of the gateway. The DMM gives a different cause, high traffic and technical improvement work. No attacker, method or malware is named in either case.
ATT&CK techniques
Who says who was behind it
No attacker is named. The claims and the official statements differ: the 2023 claims said login data had leaked, and the office said the infrastructure was not breached and the data came from users' devices. The 2026 claims said the gateway was attacked and had collapsed, and the DMM said there was no attack and that high traffic and improvement work caused the access problems. These are claims set against official denials. The sources opened include no independent check of either side.
Impact
Per the official statements, no breach of the gateway infrastructure occurred, and the data in the 2023 claim came from users' devices. The sources opened give no count of affected accounts and no confirmed loss. The claim figures circulating in 2023 are not repeated here because no official source confirms them.
Government and regulator response
The Presidential Digital Transformation Office answered within a day in February 2023 and recommended two-factor authentication. The DMM answered the June 2026 claims and asked the public to rely on official announcements.
The sources opened mention no arrest, court case or regulator action over these claims, and no change in law tied to them. The Türkiye country page covers the wider legal framework, including Law 7545 of 2025.
Lessons
-
A platform can be intact while accounts are still stolen
The office says the login data came from users' devices. A secure platform does not protect a password that malware or a fake page has already taken.
-
A second step limits stolen passwords
The office recommends two-factor authentication. With it, a stolen password alone is not enough.
-
Claims spread faster than checks
Both episodes began with unverified claims and ended with a denial. Say what was checked, when, and by whom.
-
Separate outages from attacks
In June 2026 the DMM pointed to high traffic and maintenance. Capacity problems and attacks look alike to users.
What to check in your own organization
-
Turn on two-factor login for your e-Devlet account
This is the step the Digital Transformation Office recommended in February 2023.
-
Treat any request for your login details with suspicion
The office says the data came from phishing. Use the official address and apps, never links in messages.
-
Keep your own devices clean
The office says the leak path was malware on devices. Keep updates and security software current.
-
Read official statements before sharing a claim
The DMM asks the public to rely on official announcements.
Where it happened
Questions
Was the e-Devlet gateway hacked in February 2023?
The Presidential Digital Transformation Office said on 26 February 2023 that inspections found no data breach in the e-Devlet infrastructure. It said the data allegedly came from attacks on individual users' devices through phishing and malware.
What did officials say about the June 2026 e-Devlet claims?
On 10 June 2026 the Disinformation Struggle Center said there had been no cyber attack, data security vulnerability or system failure. It said temporary access problems came from high traffic and ongoing technical improvement work.
How can e-Devlet users protect their accounts?
The Digital Transformation Office recommended turning on two-factor authentication. It said passwords are never kept as plain text and only hash values are compared at login.
Where can I read the official statement on the June 2026 claims?
The Presidency Communications Directorate published it on iletisim.gov.tr on 10 June 2026 under the title on cyber attack and collapse claims about e-Devlet.
Is this the first time e-Devlet data leak claims were denied?
No. Anadolu Agency carried a Digital Transformation Office statement from 13 April 2022 that also rejected a data leak claim, saying detailed checks found no data leak in the gateway infrastructure.
Sources
- e-Devlet'e yönelik siber saldırı ve çökme iddialarına ilişkin açıklama (10 June 2026) Presidency Communications Directorate (iletisim.gov.tr)
- Cumhurbaşkanlığı Dijital Dönüşüm Ofisi: e-Devlet Kapısı altyapısında herhangi bir veri sızıntısına rastlanmamıştır (26 February 2023) Anadolu Agency, carrying the Digital Transformation Office statement
- Cumhurbaşkanlığı Dijital Dönüşüm Ofisi'nden e-Devlet Kapısı veri sızıntısı iddialarına ilişkin açıklama (13 April 2022) Anadolu Agency, carrying the Digital Transformation Office statement
- Phishing, Technique T1566 - Enterprise MITRE ATT&CK
- DMM, e-Devlet'e siber saldırı iddialarını yalanladı Dünya, reporting a DMM statement
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.