Data of 140 thousand students and 4 thousand 500 staff may have been stolen: YTU officially admitted

Yıldız Technical University's (YTU) virtualization infrastructure and servers were affected by a ransomware attack. The Personal Data Protection Board (KVKK) announced that approximately 140 thousand students and 4,500 personnel may have been affected by the breach. The number of affected visitors has not yet been determined.

KVKK announcement was as follows:

“As it is known, paragraph (5) of Article 12 of the Personal Data Protection Law No. 6698, titled “Obligations regarding data security”, states that “In case the processed personal data is obtained by others through illegal means, the data controller shall notify this situation to the relevant person and the Board as soon as possible. If necessary, the Board may announce this situation on its own website or through another method it deems appropriate.” commands its judgment.

In summary, in the data breach notification submitted to the Board by Yıldız Technical University, which is the data controller;

The violation started on 01.10.2026 and was detected on the same day,

The virtualization infrastructure of the data controller and the servers running on it were affected by the ransomware attack,

The relevant group of persons affected by the violation are students, staff and visitors,

According to available records, the number of relevant people who may be affected by the violation is approximately 140,000 students and 4,500 personnel, and the number of visitors has not yet been determined,

It is stated that the categories of personal data affected by the breach could not be determined.

"Although the investigation on the issue continues, with the Decision of the Personal Data Protection Board dated 07.10.2026 and numbered 2026/2203, it was decided to announce the data breach notification on the Authority's website."