04.09.2026 11:00
The KVKK investigation into the data breach at the famous restaurant chain Baydöner, where the full names, phone numbers, emails, and city information of 505,337 customers were compromised, has been completed. The investigation found that there was no alarm mechanism to detect unusual system activity, and Baydöner was fined a total of 1 million TL in administrative penalties for data security and notification obligations.
The Personal Data Protection Authority (KVKK) has completed its investigation into the data breach at the renowned restaurant chain Baydöner, where personal information of more than 500,000 customers was stolen.
HACKERS STOLE THE DATA AND MESSAGED THE EXECUTIVE
According to the details reflected in the investigation file, cybercriminals obtained a company employee's access credentials and infiltrated Baydöner's information systems. In the attack, the full names, genders, email addresses, phone numbers, and cities of residence of 505,337 customers fell into the hands of the hackers. After copying the data in the system, the attackers later sent a message to the mobile phone of a senior company executive, notifying them that the data was in their possession. Following this development, Baydöner's management filed an official notification with KVKK, and the review process was initiated.
LACK OF ALARM SYSTEM AND TRAINING REVEALED NEGLIGENCE
After examining the incident in detail, KVKK concluded that the administrative and technical measures for ensuring data security were insufficient. In the inspections, the absence of an alarm infrastructure to detect unusual activities in the company's system and alert authorities was deemed the most serious security vulnerability and supervisory deficiency. Additionally, it was determined that the data security training provided to employees was inadequate, and access authorizations were not strictly audited.
TOTAL FINE OF 1 MILLION LIRA UNDER TWO SEPARATE ITEMS
In line with the chain of identified negligence, KVKK imposed an administrative fine of 800,000 lira on Baydöner for failing to take the necessary administrative and technical measures for data security. The authority also decided to impose an additional fine of 200,000 lira due to the failure to inform affected customers about the data leak in a timely and proper manner. Thus, the total fine imposed on the famous restaurant chain reached 1 million lira.