More than six million Eve Kozmetik customer records sit in Turkey’s September 2026 KVKK disclosure wave—the largest single headcount among the twelve Board Decision 2026/2039 notices published on September 16. Eve Kozmetik (legal controller Yeni Mağazacılık A.Ş.) told the Personal Data Protection Authority that unauthorized access hit a data-processor server through a vulnerability in a third-party software library; the processor notified Eve on September 10, 2026, six days before the regulator’s public kamuoyu duyurusu went live.
That is a verified Eve Kozmetik data breach under Turkish law: company-reported, regulator-published, not a leak-site rumor. Attested fields are names, email addresses, and phone numbers for customers—contact data criminals use immediately for SMS OTP scams, fake loyalty refunds, and cosmetic-counter phishing. The catalog count is 6,263,305 people; combined with eleven peer notices that could state a number, Turkish press described more than ten million affected individuals across the batch.
KVKK has said its review of the twelve filings continues and has not confirmed one shared attacker across every brand, even though several notices cite third-party libraries or processors. For Eve shoppers, the split between “shared supply chain” and “isolated processor flaw” matters less than whether your mobile number and email now circulate in criminal marketplaces.
The canonical BreachHistory record is /eve-kozmetik/eve-kozmetik-kvkk2026. Primary notice: KVKK — Yeni Mağazacılık A.Ş. (Eve Kozmetik).
Processor notice on September 10, public KVKK post on September 16
Eve’s root cause narrative in the indexed record is specific among cluster peers: unauthorized access on a data-processor server, enabled by a third-party library vulnerability, with the processor informing Eve Kozmetik on September 10, 2026. KVKK published the kamuoyu duyurusu on September 16, 2026—the statutory public layer that turns an internal notification into nationwide news.
- On or before September 10, 2026 — The data processor detects or learns of unauthorized access involving Eve Kozmetik customer personal data on infrastructure it operates for processing duties.
- September 10, 2026 — The processor notifies Eve Kozmetik as data controller, per the indexed technical writeup.
- September 16, 2026 — KVKK publishes the public notice naming 6,263,305 affected customers and describing names, emails, and phone numbers.
- September 17, 2026 onward — Turkish Minute and Memurlar.net frame the twelve-company cluster for English- and Turkish-reading audiences.
What the indexed English summary does not yet include is a CVE number, the processor’s commercial name, or a line-by-line Turkish PDF translation of every remediation step Eve promised KVKK. Treat those as open questions until primary Turkish disclosures or a company FAQ addresses them.
What was exposed—and what Eve did not confirm
KVKK’s published categories for Eve Kozmetik are names, email addresses, and phone numbers for customers. That trio is enough to run convincing Turkish-language campaigns: beauty brands already email seasonal promotions and SMS limited-time discounts, so post-breach lures inherit plausible tone and timing.
To be clear: the notice indexed by BreachHistory does not list payment card numbers, national ID (T.C. kimlik) numbers, full home addresses, or password hashes for Eve specifically. Do not assume credentials leaked unless a future KVKK update or Eve statement says so. Several other companies in the same September cluster had press summaries mentioning login or password fields; that pattern is not automatic proof about Eve.
Cosmetics loyalty programs often store birth dates for age-gated products and shade preferences for marketing—fields not attested in the indexed Eve record. If you receive phishing that references an exact foundation shade or store visit date, treat the detail as either public social media inference or a sign of a deeper dump that has not been regulator-confirmed.
How a third-party library on a processor server fits the attack story
“Third-party software library on a server that processed company data” is the mechanical heart of Eve’s filing. In plain terms, Eve relied on an external processor to run some data workflow—CRM sync, campaign export, e-commerce middleware, or loyalty analytics—and that processor ran code depending on a library with a known or newly discovered flaw. Attackers who exploit such flaws on processor infrastructure can reach multiple controllers if the same stack serves several retailers; KVKK has not confirmed that Eve shares the flaw with every brand in the September batch.
Security teams outside Turkey should read Eve’s notice as a processor-governance case study: contractual breach notification (processor → controller by September 10), library patch cadence on vendor servers, and evidence retention for KVKK examination. Customers should read it as contact-data exposure with high phishing yield.
Who is at risk among six million customers
In-store loyalty and beauty consultants’ client books
Eve Kozmetik’s high-street presence means millions of sign-ups tied to mobile numbers for SMS receipts and points balances. If your number was on a loyalty card, expect parcel-style SMS fraud and WhatsApp messages pretending to be “Eve müşteri hizmetleri.”
Online checkout and app accounts
Email plus name enables password-reset spam even when passwords were not in the notice. Attackers spray “Eve Kozmetik hesap doğrulama” links to harvested inboxes. Open the official site from a bookmark, not from email.
Gift buyers and holiday-season shoppers
Cosmetics purchases spike before holidays; criminals timing lures after September 16 know many recipients expect gift-with-purchase codes. A fake “Eve hediye seti kargo ücreti” message can reference a real given name from the breach.
Cross-border shoppers and diaspora
Turkish phone numbers in CRM rows may belong to citizens abroad. +90 SMS and Turkish-language email still reach diaspora inboxes; home-country banks may not recognize the brand in fraud alerts unless you add a merchant note.
Employees and store staff (possible overlap)
The 6,263,305 figure is customer-scoped in the catalog title. Staff data is not listed in the indexed field set. Store employees should still watch for internal phishing citing KVKK fines or “mandatory Eve security training” links after press coverage.
Phishing and fraud scenarios naming Eve Kozmetik
Illustrative lures—patterns matter more than exact text:
Fake loyalty points expiry: “Eve Kozmetik: 6.263 puanınız 24 saat içinde silinecek — [link].” Real programs show balances only after login in the official app.
Processor apology email: “Yeni Mağazacılık / Eve veri ihlali tazminat formu — kimlik ve IBAN.” KVKK does not operate per-brand compensation upload portals.
Counterfeit dermatology safety scare: “Eve ürününüz geri çağrıldı — kargo adresinizi onaylayın.” Uses name + phone; verify through Eve’s published customer line or in-store staff you initiate contact with.
SMS one-time password relay: A caller says Eve’s security team needs the SMS code “they just sent you.” Eve will not ask you to read OTPs aloud to cold callers.
Instagram DM “influencer collab”: After mega-breach headlines, fake brand reps DM micro-influencers asking for login credentials to “verify Eve partnership.”
Eve Kozmetik in the twelve-company KVKK cluster
Eve’s 6,263,305 count alone exceeds many national breach totals. Turkish Minute’s reporting placed the combined disclosed headcount above ten million when summing companies that could publish numbers. Eve sits at the top of that league table in the BreachHistory manifest—ahead of Shaya Mağazacılık’s 2.3 million and Deniz Deniz Butik’s 1.27 million in the same week.
Regulatory caution against declaring one monolithic campaign still applies. Shared processor economics are plausible in Turkish retail; KVKK has not issued a single attribution tying all twelve notices to one intrusion set. Threat hunters should correlate IOCs; consumers should assume contact details for Eve relationships are in play.
What Yeni Mağazacılık and KVKK said through the public record
Yeni Mağazacılık A.Ş., trading as Eve Kozmetik, confirmed the breach to KVKK with companyConfirmed true in the catalog. KVKK published the kamuoyu duyurusu with the customer count and data categories above. KVKK stated examinations continue across the related notifications.
Direct customer letters, call-center scripts, and free credit monitoring—common in other countries—may follow under Turkish practice but were not part of the English-indexed writeup at catalog time. Watch Eve’s official Turkish website and in-store notices for data-subject outreach.
KVKK rights and practical Turkish context
Law No. 6698 requires controllers to notify KVKK when breaches risk harming data subjects. Public announcements inform citizens who may never receive a private email because the company holds only a phone number—or because outreach is still rolling. Individuals may lodge complaints with KVKK if they believe processing violated the law; complaints do not replace rotating reused passwords or blocking spam numbers.
Retail cosmetics sits in a sector that already fights counterfeit product fraud. A contact-data breach adds a digital layer: scammers sell fake Eve palettes through cloned shops that feel credible when they greet you by name.
What you should do if you shopped Eve Kozmetik
- Save the KVKK notice PDF from the official link; criminals clone regulator seals on fake sites.
- Assume names, email, and phone for your customer profile may be exposed per the September 16 notice—plan for phishing, not for panic about unconfirmed payment data.
- Change passwords reused between Eve web accounts and email, banking, Trendyol, or Hepsiburada marketplaces.
- Enable bank and Papara alerts; retail contact breaches often precede card testing even when PANs were not in the KVKK summary.
- Reject cold calls asking for OTP codes, kimlik photos, or “Eve security verification” passwords.
- Contact Eve only via channels published on official properties, not Telegram “support” accounts appearing after news cycles.
- Report SMS phishing to your operator and KVKK when messages abuse the Eve Kozmetik name with suspicious short links.
- Wait for company-directed remediation before uploading identity documents to third-party “class action” Instagram ads.
Searching “Eve Kozmetik breach 2026” and “was I affected”
Have I Been Pwned and similar services may lag Turkish-only regulatory posts. Absence of your email there does not prove you are outside the 6,263,305 if Eve held only your phone or a secondary address. Match the legal entity Yeni Mağazacılık A.Ş. and the September 2026 KVKK notice, not unrelated “Eve” brands globally.
Supply chain lessons for other retailers (without inventing Eve specifics)
Processor-side library flaws are patch-management problems for vendors and contractual notification problems for controllers. If your company sends customer PII to a Turkish loyalty processor this month, ask for September 2026 incident attestations and subprocessor maps—not because Eve’s processor is named in the indexed record, but because KVKK’s cluster showed how fast six-million-row disclosures become front-page news.
Family phones, shared loyalty, and minors
Households often register one mobile for the whole family’s Eve points. One CRM row can mean multiple people see the same phishing SMS. Parents who signed up teens for student discounts should warn them about gift-card scams referencing Eve Kozmetik after KVKK publicity.
Canonical record and sources
BreachHistory: 2026 Eve Kozmetik — KVKK notice; 6,263,305 customers.
- KVKK — Eve Kozmetik (Yeni Mağazacılık) kamuoyu duyurusu
- Turkish Minute — twelve companies, 10M+ people
- Memurlar.net — KVKK twelve-company disclosure
The verified core is narrow and firm: processor-discovered unauthorized access via a third-party library on processing infrastructure, processor told Eve on September 10, KVKK told the public on September 16, and 6,263,305 customers’ names, emails, and phones are in scope. Everything else—vendor name, CVE, criminal attribution—awaits richer primary Turkish text. Plan defenses around contact-data fraud anyway; at six million rows, that is where Eve Kozmetik customers will feel the breach first.
Why scale changes fraud economics
At six million contacts, even a low single-digit click rate on SMS lures yields massive victim counts. Turkish-language templates spread through affiliate fraud networks within days of KVKK posts. You do not need a public paste bin to suffer—the regulator’s website is enough signal for criminals.
Eve Kozmetik’s beauty category adds emotional hooks: product allergies, “free dermatologist sample,” and limited-edition collaborations. Combine those hooks with a real first name from the notice’s field set and the conversion rate climbs. Skepticism is your best product.
Physical stores after a digital notice
KVKK publication does not close shops. Staff may field walk-in questions before headquarters distributes talking points. If you visit an Eve store, ask for written privacy guidance rather than verbal promises about whether your loyalty ID is in scope—store tablets may not yet show the same case management view as the DPO office.
Receipt QR codes and paper loyalty stamps still link to the same CRM backbone that fed the processor environment described in the notice. Digital and in-store channels are one ecosystem from a fraudster’s perspective even when your shopping habit was only physical.
Data minimization questions Eve customers can ask
KVKK grants data subjects rights to learn what controllers hold and why. After a six-million-row notice, polite but firm requests for confirmation whether your loyalty ID is in scope—submitted through Eve’s official privacy channel—create paper trails if scammers later abuse your phone. That is not paranoia; it is how Turkish consumers document responses when direct letters lag the kamuoyu duyurusu.
Ask whether the processor that notified Eve on September 10 still processes your data or was replaced. The answer may arrive in Turkish legalese; bring a trusted translator if needed. Do not paste kimlik numbers into random web forms that promise “Eve breach lookup tools.”
Counterfeit cosmetics risk after contact leaks
Beauty fraudsters sell fake serums through Instagram shops that DM leaked emails with “Eve exclusive distributor” claims. Real Eve promotions route through official apps and stores. Counterfeit products pose health risks beyond identity theft—report suspicious sellers to Eve’s published customer channels and marketplaces.
Processor notification law in plain language
When a processor tells a controller about unauthorized access, Turkish law expects the controller to assess harm and notify KVKK within statutory windows. Eve’s September 10 processor date and September 16 public notice show that pipeline in motion. Customers should not interpret the six-day gap as proof of cover-up without evidence—regulatory timelines and internal forensic scope work both consume days.