Data Breach Notification from KVKK for Nesine

Personal Data Protection Authority (KVKK), D Elektronik Şans Oyunları ve Yayıncılık A.Ş. published a data breach notification for the Nesine platform operating within the company. According to the information shared by the institution on its official website, it was determined that a cyber attack was carried out against the call center infrastructure from which service is provided by the company.

In this incident, which occurred after outages in the systems on September 30, 2026, it was reported that the attackers encrypted the data and made it inaccessible. After realizing the situation, Nesine initiated legal processes, provided the necessary information to the KVKK, and deepened the technical investigations to prevent the affected users from suffering.

Details of the Attack and Affected Data Have Been Determined

In the initial investigations, no concrete evidence has yet been found that the data was transferred out of the system. However, considering the time the attackers stayed in the system and the shared nature of the infrastructure, the possibility of unauthorized access cannot be completely ruled out. In the notification made to KVKK, it was stated that the violation especially covers customers communicating through the call center. In this context, it is considered that the data of potential customers who call the call center and contact existing members called by the company for membership transactions are at risk.

Forensic Investigations Continue

The company announced that call audio recordings and call detail records (caller/called number, date, time and call duration) kept in its infrastructure were affected by the attack. Final results are expected to emerge as a result of detailed examinations by forensic computer experts. Nesine management emphasizes that technical teams work 24/7 to understand the extent of the violation and re-establish user security. The process carried out by the data controller in question is meticulously monitored to determine whether the identity information of people affected by the breach has been disclosed.

Security Measures Are Being Reviewed

This cyber attack once again demonstrated the importance of third-party supplier security for companies operating in the financial and games of chance industry. Nesine announced that the necessary patches have been applied to close the security vulnerabilities in the systems of the business partner from which it receives call center services and that the systems have been revised to provide a more secure structure. KVKK, on ​​the other hand, reminds data controllers of their obligation to monitor the security of the data processors they receive service from, and underlines that all necessary administrative and technical measures must be taken to prevent similar violations from recurring.