21.07.2026 10:40
Striking new findings have emerged in the Gülistan Doku investigation. An examination of over 28 million records by the Ministry of Health and cybersecurity experts revealed that hospital records belonging to Gülistan Doku were deliberately deleted from the system. It was determined that log records from December 31, 2019, were completely destroyed, while health data created on January 8 and 13, 2020, was deleted within a short period via an IP address belonging to Tunceli State Hospital.
As part of the investigations into the disappearance of Gülistan Doku, coordinated by the Chief Public Prosecutor's Offices of Erzurum and Tunceli, simultaneous operations were conducted on July 21, 2026, in Elazığ, Malatya, Tunceli, Ankara, and Istanbul. Based on new evidence obtained in the investigations, expert reports, digital examinations, Ministry of Health records, HTS and MASAK analyses, as well as witness and confidential witness statements, a total of 15 suspects were detained, including healthcare workers, IT and data entry personnel, security guards, a businessperson, and the owner of an IT company.
HOSPITAL RECORDS FOUND TO BE INTENTIONALLY DELETED
In the investigation conducted by the Erzurum Chief Public Prosecutor's Office, a detailed technical examination was carried out on Gülistan Doku's health records at Tunceli State Hospital.
The examinations revealed that Gülistan Doku's hospital record dated December 31, 2019, existed, but the log records for this date were deleted from the system. It was determined that not only Gülistan Doku's but also all individuals' log records who received services from the hospital on the same date were destroyed, whereas the visit and examination records for the same day remained in the system.
It was reported that the deletion of log records was not due to any technical malfunction, and the process was assessed to have been carried out as a result of a deliberate and intensive intervention requiring technical knowledge.
MINISTRY OF HEALTH EXAMINED OVER 28 MILLION RECORDS
The Ministry of Health's General Directorate of Health Information Systems and the Cyber Incident Response Center examined over 28 million records in databases across Turkey.
In the examinations, it was determined that an SGK (Social Security Institution) provision was obtained for Gülistan Doku via the SISOFT Hospital Information Management System on January 8, 2020, at 16:04:51, and a unique tracking number was created four seconds later.
It was found that this record was deleted one minute after its creation via the IP address allocated to Tunceli State Hospital. Furthermore, it was officially documented that another health record belonging to Gülistan Doku was destroyed on January 13, 2020, through a systemic deletion package sent from the same hospital IP address.
INVESTIGATION INTO 10 HEALTHCARE PERSONNEL
Within the scope of the investigation, simultaneous operations were conducted against a total of 10 suspects, including 3 doctors, 1 nurse, 1 IT staff member, and 5 data entry and control personnel, who were assessed to be linked to the operations carried out on hospital records.
It was stated that the suspects were being investigated for crimes including destroying, hiding, or altering evidence of a crime; unlawfully providing or seizing data; damaging, destroying, or hiding official documents to impede their function; and destroying, altering, or making data inaccessible in an information system.
OPERATIONS ON HOSPITAL RECORDS EXAMINED INDIVIDUALLY
In the investigation, it was determined that doctor Furkan Karabulut performed operations on Gülistan Doku's hospital records on December 27 and 31, 2019, and January 24, 2020, while doctor Ezgi Erdal Karakaş performed operations on December 27 and 29, 2019.
Doctor Hüseyin Kocaaslan was identified as having examined Gülistan Doku in the general surgery department on September 16, 2019, ordered blood tests, hospitalized her with a diagnosis of gastritis, and discharged her on September 18, 2019.
Additionally, while the police report stated that Gülistan Doku entered Tunceli State Hospital at 09:09 on December 31, 2019, information was obtained that the doctor logged into the system at the same date and time, according to the Hospital Information Management System's user list, was Hüseyin Kocaaslan. Therefore, it was assessed that Kocaaslan might be the person who opened the hospital record in question.
'DELETE' OPERATIONS UNDER SCRUTINY
It was determined that IT specialist Emine Yılmaz performed deletion operations on Gülistan Doku's hospital data on January 8 and 13, 2020, and data entry control operator Tamer Siler also performed deletion operations on the records on the same dates.
It was found that data entry personnel Mustafa Yıldız performed a "delete" operation on hospital data belonging to Gülistan Doku on December 31, 2019, and also performed operations on the records on January 8 and 13, 2020, and it was assessed that Mömün Polat acted jointly in this process.
It was reported that Yeter Satıcı and nurse Alev Şan performed operations on Gülistan Doku's hospital records on different dates, while Yoldaş Altaş was determined to have sent money to IT specialist Emine Yılmaz on various dates, and the money flows were under investigation.
HTS, HANDAN SONEL, AND IT COMPANY ALSO IN THE FILE
In the investigation, it was found that some suspects had intensive telephone contacts with other names in the file, while within the scope of the investigation conducted by the Tunceli Chief Public Prosecutor's Office, a detention decision was issued for Handan Sonel, wife of former Tunceli Governor Tuncay Sonel; businessperson Okan Yarıcı; security guard Fatih Özmen; former head guard Yılmaz Arslan; and Memet Aca, owner of ACA IT Company.
As part of the investigation, the claim that the backup SIM card of the GSM line used by Gülistan Doku was sent to the IT company for "cleaning" was also taken under examination, while the information about intensive MASAK (Financial Crimes Investigation Board) transactions between Memet Aca and the then Tunceli Governor Tuncay Sonel also entered the investigation file.
15 SUSPECTS IN CUSTODY
Within the scope of the second wave of operations conducted under the instruction of the Erzurum and Tunceli Chief Public Prosecutor's Offices, a total of 15 suspects were detained in Elazığ, Malatya, Tunceli, Ankara, and Istanbul.
It was reported that the suspects' statement procedures, digital materials, communication records, financial transactions, and examinations related to hospital information systems were ongoing, and the investigation was continuing in multiple directions with the aim of fully elucidating all aspects of Gülistan Doku's disappearance.