KVKK enforcement following industrial ransomware attacks

The Turkish Personal Data Protection Authority (KVKK) has issued administrative fines to industrial companies following significant ransomware attacks and subsequent data breaches.

In the first instance, an automotive security and electronic systems manufacturer was fined 500,000 Turkish Lira. The breach, potentially originating from a compromised service provider account, resulted in the encryption of server files and the online publication of identity, contact, and health data belonging to customers, suppliers, and employees. The KVKK cited failures in monitoring information systems and detecting unusual network activity.

Subsequently, a global industrial company received a 1 million lira fine after ransomware spread across 797 servers. The attack was triggered by an employee in the United States downloading a program from the internet, compromising the data of 4,885 individuals, including passport numbers and IBAN details. The KVKK noted that the company had failed to resolve previously identified vulnerabilities, maintained weak password policies, and failed to report the breach within the required timeframe.