Hepsiburada data breach: 9,882 people affected

Hepsiburada data breach was announced on the official website of the Personal Data Protection Authority (KVKK). D-Market Electronic Services and Trade Inc. In the notification sent to the Board on behalf of the Board, it was stated that a cyber attack affected personal data. The institution shared the notification with the public today. The notification also reveals the scope of the incident and the types of data affected. Therefore, it is necessary to consider the details in order.

How did the Hepsiburada data breach occur?

Accordingly, the problem occurred in the data processing company that provided chat infrastructure service to Hepsiburada. Unauthorized access was gained to some records hosted by this company by a cyber attacker or attackers. The records accessed are chat records dated 2022. Therefore, the incident covers chat data dated 2022.

Additionally, the number of people affected by the breach was reported as 9,882. In other words, the incident occurred not directly in Hepsiburada systems, but in the infrastructure of the third party from which it received service. Nevertheless, Hepsiburada made the notification as the data controller. That's why the name D-Market is included in the notification.

What Data Was Affected?

The affected data are collected in three main groups. These are listed as follows:

Identity: name and surname

Contact: mobile phone, email address and address

Customer transaction: order number, shipment number, request and complaint records, purchased or canceled product information

For example, order number, shipment number and request records are included in the customer transaction group. Moreover, purchased or canceled product information also falls into the same group. On the other hand, the contact group consists of mobile phone, e-mail address and address.

However, the Hepsiburada data breach does not only cover customers. Affected contact groups include employees, customers, and potential customers. Supplier employees, business partners and vendors are also included in this list. Therefore, the domain is not limited to a single user group.

KVKK Process and Information Channels

KVKK announced that the investigation into the issue is continuing. With its decision dated 04.11.2026 and numbered 2026/2438, the Personal Data Protection Board decided to announce the notification on the Authority's website. Therefore, the public was officially informed about the process. For this reason, the Hepsiburada data breach is officially recorded.

On the other hand, two channels were specified where relevant people could receive information. One of these is the e-mail address included in the notification, and the other is the call center at 0850 252 40 00. Affected users will be able to submit their questions about the Hepsiburada data breach through these two channels. Since the investigation is ongoing, a new statement is expected to be made regarding the outcome of the process.

The Authority also published data breach notifications for KVK Technical Service and Vava Cars on the same day.