Data Breach Notification from KVKK for Yıldız Technical University

KVKK announced the ransomware-related data breach affecting 140 thousand students and 4 thousand 500 staff at Yıldız Technical University. Details are in our news.

With the announcement made on its official website today, the Personal Data Protection Authority (KVKK) announced to the public that there was a serious data breach within Yıldız Technical University. The cyber attack, which took place on 01.10.2026 and was detected on the same day, targeted the university's virtualization infrastructure and the servers running on this system. This attack, which is said to be caused by ransomware, put the personal data of approximately 140 thousand students and 4,500 staff at risk. According to the first information shared by the institution, the categories of leaked data have not yet been clarified in the incident in which visitors were also affected.

Details of the Attack and Infrastructure Damage Revealed

Cyber attackers targeting the university's digital infrastructure aimed to gain control over the servers by disabling the virtualization layer at the center of the system. Ransomware attacks generally work on the principle of encrypting data and demanding payment from the institution to unlock it. In the statement made by KVKK, it was stated that technical teams started the intervention process as soon as the violation was detected. However, the width of the system and the intensity of data traffic make it difficult to determine the extent of the breach.

The Process is Followed for the Security of Personal Data

The fact that the number of people affected by the violation is quite high once again reveals the seriousness of the incident. It is stated that the university administration works in coordination with KVKK, especially considering the sensitivity of student and staff information. The fact that an exact number of visitors cannot be given yet shows that the attack affected the entire network traffic of the university. While digital forensic investigations to identify relevant data categories continue, corporate security protocols are updated to prevent victimization.

Cyber Security Measures Are Being Reviewed

This incident proves how vulnerable educational institutions can be to cybersecurity vulnerabilities. Experts emphasize that especially large-scale universities should establish a more layered defense mechanism against modern ransomware. It is thought that this violation on Yıldız Technical University serves as a warning for other institutions. While KVKK renews its warnings for data controllers to take the necessary technical and administrative measures, the investigation process continues to progress within the legal framework.