Turkiye: Personal Data Protection Authority announced investigation into Biletal over data breach

On 14 August 2025, the Personal Data Protection Authority (KVKK) announced the launch of an investigation into a personal data breach reported by Biletal Domestic and Foreign Trade. The breach was detected on 11 August 2025 by the company’s IT teams in coordination with the Information and Communication Technologies Authority, after cyber attackers offered customer identity, contact, and transaction data for sale on illegal online platforms. The incident is estimated to have affected around 7,800 customers. The KVKK Board decided, under Decision No. 2025/1481, to publish the breach notification on its website while the investigation is still ongoing.