2026 Baltaş Eksen — KVKK SQL injection breach notice (June 3–8 incident)
Data compromised
Potentially affected: user identity and contact data, session/access logs, SharePoint corporate files with customer/partner information—employees, users, customers, and prospects; exact categories and counts under investigation
Technical writeup
Turkish KVKK regulator notice — June 24, 2026 (Decision 2026/1264). Baltaş Eksen Seçme Değerlendirme Eğitim ve Org. Tic. AŞ reported a SQL injection incident occurring June 3–8, 2026, detected June 16. Technical review ongoing; potentially affected categories include identity/contact data, transaction-security logs, and SharePoint customer/partner files. Affected groups may include employees, users, customers, and prospects; victim count unknown at notice time.
Root cause
SQL injection attack against Baltaş Eksen web application June 3–8, 2026; detected June 16, 2026—KVKK public notice June 24, 2026 (Decision 2026/1264)