KVKK fines global company 1 million lira after data breach

The Personal Data Protection Authority (KVKK) has imposed a 1 million lira administrative fine on a global industrial company following a significant data breach. The incident originated when an employee in the United States ran a program downloaded from the internet, allowing ransomware to spread across 797 servers within the company’s global network and encrypt numerous files.

The breach affected 4,885 individuals, including employees, customers, and suppliers. Compromised data included identities, passports, addresses, IBAN numbers, telephone numbers, and blood types.

Investigations revealed that the company had previously identified critical security vulnerabilities during penetration tests but failed to provide documentation proving they had been resolved. The KVKK also noted several security failures, such as simple password policies, insufficient cybersecurity awareness among staff, overly broad network access, and the use of outdated operating systems without critical updates. Additionally, the company failed to report the breach within the required timeframe, notifying the authority 23 days after the incident occurred.