DHL employee data leaked from survey

Personal Data Protection Authority (KVKK) announced the DHL data breach reported by DHL AG on its official website. The breach occurred in an environment where the company kept employee surveys. However, those affected are not the customers, but the 10,622 employees employed in Türkiye.

How the DHL data breach happened

DHL AG conducts employee surveys centrally. For these surveys, services are received from a data processor. Therefore, the data resided in the data analysis and reporting environment operated by the processor. Unauthorized access was also achieved in this environment.

The breach was detected on November 2, 2026. DHL AG, as the data controller, reported the situation to the Board. In other words, the leak occurred not in the company's own systems, but in the environment of the processor from which the service was received. For this reason, the party making the notification and the environment from which access is provided are separate from each other.

Data affected and number of people

According to KVKK's statement, three categories of data were affected by the breach:

Identity data

Contact data

personnel data

The affected contact group is employees. The number was determined as 10,622 people in Türkiye. Moreover, this figure in the statement only covers employees in Türkiye.

Personal data describes information about the employee's employment relationship. Identity and contact data are information that identifies the person and allows us to reach him. Because the breach affected these three categories together, the information of the affected employees remained compromised in different types.

KVKK's decision and process

With its decision dated 11 November 2026 and numbered 2026/2483, the Board ruled that the notification be announced on the Authority's website. The announcement was released on November 12. The investigation into the matter continues.

The institution did not give a date for when the review would be concluded. For this reason, what is known about the DHL data breach file for now is limited to the announcement published by the Board. Since the investigation is ongoing, it is possible that there will be a new development in the process.