KVKK fines food sector company 1 million TL after data breach

The Personal Data Protection Authority (KVKK) has imposed a total fine of 1 million TL on a company operating in the restaurant and fast-service food sector following a significant data breach. The breach affected the personal data of 505,337 customers.

Investigations revealed that cyber attackers gained unauthorized access to an IT department employee's computer via malware running on a web browser. By capturing saved usernames and passwords from the browser, the attackers were able to access the company's internal systems. The attackers later notified a company executive via mobile message that they possessed certain company data.

The KVKK issued two separate administrative fines: 800,000 TL for the failure to implement adequate technical and administrative measures to ensure data security, and 200,000 TL for failing to fulfill the legal obligation to notify the affected individuals in a timely manner. The authority noted that the breach carried a high probability of causing negative impacts on the affected individuals.