Article
Data Leaks: The Silent Killer of Trust — And How to Stop Them
A data leak is the unintentional and often unnoticed exposure of sensitive, confidential, or proprietary information to unauthorized parties.
Read more
Significant cyber incident
Leak of personal data of nearly 50 million Turkish citizens
In April 2016 a database with the personal details of nearly 50 million Turkish citizens was posted online.
In short
In April 2016 a database with the personal details of nearly 50 million Turkish citizens was posted online. AP and AFP reported it, and Turkish authorities opened an investigation. The data included names, identity numbers and addresses. The Interior Minister said it did not come from the central civil registration system, and no report opened describes how it got out.
What happened
The Associated Press reported that a database with 49,611,709 entries holding private information on nearly 50 million Turkish citizens had been posted online, on a site that appeared to be hosted by an Icelandic group that publishes leaks. AFP reported on 6 April 2016 that Turkish authorities had opened an investigation into the alleged leak of personal data of about 50 million citizens, including names, identity numbers and addresses.
Al Jazeera adds that the posted data covered roughly two-thirds of the population, and that Turkish identity numbers give access to state services including voting, social security, military recruitment, medical care and banking. Al Jazeera says it verified that the identity numbers and names it checked were authentic.
Anadolu Agency reported that the Ankara Chief Public Prosecutor’s Office opened the investigation and planned to contact the Supreme Electoral Committee and the General Directorate of Population and Citizenship Affairs, and that prosecutors noted voter data is shared with political parties before elections.
Timeline
-
24 March 2016
Law 6698 on the protection of personal data is adopted, according to the law text.
-
April 2016
The database is posted online and reported by AP.
-
6 April 2016
AFP and Al Jazeera report that Turkish authorities have opened an investigation.
-
6 to 7 April 2016
The Interior Minister says the leak did not come from the central registration system, according to Anadolu Agency.
-
7 April 2016
Law 6698 is published in the Official Gazette (number 29677).
How the attack worked
What the sources say about the leak
None of the reports opened describes how the data got out. AFP says the site that hosted it appeared to be linked to an Icelandic group that publishes leaks, and that a statement on the site criticized Turkish governance. Officials did not say where the data came from.
What officials said about the source
Interior Minister Efkan Ala said the leak did not come from the central civil registration system or the General Census Directorate. Justice Minister Bekir Bozdag said he did not know where or how it had leaked, but that the size was close to the number of voters in Turkey. AFP quotes him saying the investigation should focus on where and how the data leaked. No official statement opened says which copy of the data was used.
Who says who was behind it
The reports name no attacker. AFP says a statement on the site that hosted the data criticized Turkish governance and that the site appeared linked to an Icelandic group that publishes leaks. Sources differ on checking: the AP tested 10 non-public Turkish ID numbers against the names in the database and eight matched; AFP wrote that the data had not been verified; Al Jazeera says it verified the numbers and names it checked. Sources also differ on the origin: the Interior Minister said it was not from the central registration system, while the Justice Minister said he did not know where it came from and noted the size matched the number of voters, and prosecutors noted that voter data is shared with political parties.
Impact
The reports give 49,611,709 entries, which AP calls nearly 50 million citizens, and AFP and Al Jazeera call about 50 million. Al Jazeera says this is roughly two-thirds of the population. The reports describe names, identity numbers and addresses, and say the data put citizens at risk of identity theft and fraud. The figure is the size of the database, not a confirmed count of people harmed.
Government and regulator response
The Ankara Chief Public Prosecutor’s Office opened an investigation. Justice Minister Bozdag announced it and, according to Al Jazeera, said a new bill would be adopted to increase protection of personal data. Prime Minister Ahmet Davutoglu said all necessary measures were being taken, and Interior Minister Ala said there was no need to worry.
The Türkiye country page records that Law 6698 on personal data protection was adopted on 24 March 2016, before these reports. The sources opened do not say whether the minister’s remark about a new bill refers to that law. They also report no arrests, court case or result of the investigation.
Anadolu Agency reports that prosecutors planned to contact institutions including the Supreme Electoral Committee and the General Directorate of Population and Citizenship Affairs, because electoral data are distributed to political parties before elections.
The text of Law 6698 shows it was adopted on 24 March 2016 and published in the Official Gazette (number 29677) on 7 April 2016, the day after the first reports. Article 12(5) says that if processed personal data is obtained by others through unlawful means, the data controller must tell the person concerned and the Board as soon as possible, and the Board may announce this on its website or by another suitable method.
Lessons
-
A national ID number cannot be changed
Al Jazeera notes that the number opens access to voting, social security, military, medical and banking services. Once leaked, it stays exposed for years, so services should not accept it alone as proof of identity.
-
Copies of data travel
Prosecutors noted that voter data is shared with political parties before elections. Every copy outside the central system is another place the data can leak from.
-
Test a claim quickly and say how
The AP checked 10 IDs it knew were not public and found eight matches. The method is simple and the result is clear.
-
First answers should cover every copy
The first official statement ruled out the central system. The Justice Minister said the inquiry should focus on where and how the data leaked.
-
The law now names a notification duty
Article 12(5) of Law 6698 requires a data controller to notify the person concerned and the Board when personal data is obtained by others unlawfully.
What to check in your own organization
-
List every place a copy of citizen data goes
Include shared lists and files held by partners or parties, not only the main system.
-
Do not use an ID number as the only proof of identity
Ask for a second factor or an extra check.
-
Watch for fraud attempts that use leaked details
The reports warn of identity theft and fraud as the risk.
-
Verify a leak claim with a small test
Match a few non-public records against the posted data, as the AP did.
Where it happened
Questions
What was leaked in April 2016?
A database with 49,611,709 entries holding private information on nearly 50 million Turkish citizens was posted online. Reports describe names, identity numbers and addresses.
Where did the leaked Turkish citizen data come from?
The reports opened do not say how it got out. The Interior Minister said it did not come from the central civil registration system, and the Justice Minister said he did not know where it came from.
Why did the leak put citizens at risk?
Al Jazeera notes that Turkish identity numbers give access to state services including voting, social security, military recruitment, medical care and banking. The data put citizens at risk of identity fraud.
Does Turkish law require telling people when their data is obtained unlawfully?
Law 6698, Article 12(5), says the data controller must notify the person concerned and the Board as soon as possible, and the Board may announce the breach on its website or another suitable method. The law was published on 7 April 2016.
Who investigated the 2016 leak?
The Ankara Chief Public Prosecutor's Office opened the inquiry, according to Anadolu Agency. Prosecutors planned to contact the Supreme Electoral Committee and the General Directorate of Population and Citizenship Affairs.
In our research
Sources
- Data of nearly 50 million Turks allegedly leaked online Associated Press, via ABC15
- Turkey to probe massive 'personal data leak' AFP, via Phys.org
- Turkey to investigate massive leak of personal data Al Jazeera, 6 April 2016
- Minister: Turkish data leak not from central system Anadolu Agency
- Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu) Official legislation database of Türkiye (mevzuat.gov.tr)
- Personal Data Protection Law No. 6698, English translation (ratified 24 March 2016, Official Gazette 7 April 2016) Personal Data Protection Authority of Türkiye (kvkk.gov.tr)
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.