Five Arrested in Turkey Over Trade Union Data Breach
A recent operation led by Turkey's National Intelligence Organization (MİT), in collaboration with the Cybersecurity Directorate and the Gendarmerie General Command, has resulted in the arrest of five individuals associated with a software company in Ankara. This firm, Aydo Yazılım, is known for supplying digital services to trade unions and was targeted after MİT discovered a query interface in its software that allegedly allowed access to personal data of individuals who were not members of any union.
During simultaneous searches of homes and workplaces in Ankara, authorities detained the company's owner and employees. Investigators uncovered that the system could query datasets previously leaked online, enabling searches using Turkish national identification numbers. This access reportedly provided sensitive identity and population registration details, with the databases containing a wide array of personal information.
The investigation revealed that the software was used to complete membership information for new union members. Alarmingly, records belonging to individuals under the age of 18 were also found within the databases. Furthermore, server examinations indicated that the abbreviation "NVİ," commonly associated with the Directorate General of Population and Citizenship Affairs, was frequently logged in the system. However, technical findings suggested that the data had not been directly sourced from government systems.
Investigation into Data Usage and Compliance
Aydo Yazılım also provided consultancy services to various institutions regarding compliance with Türkiye's Personal Data Protection Law, known as KVKK. Authorities are now working to determine which unions utilized the system, the extent of its application, and the purposes for which the data was processed. The investigation may expand based on additional evidence retrieved from the digital materials that were seized during the operation.
Final Assessment
As the investigation unfolds, the implications of this data breach raise significant concerns regarding the security of personal information within trade unions. The potential misuse of such data could have far-reaching consequences for individuals whose information was compromised. Authorities are prioritizing the examination of the unions involved to assess the full scope of the breach and to implement necessary measures to protect sensitive information in the future.
The arrests and the ongoing investigation highlight the critical need for robust cybersecurity measures within organizations handling personal data. As the situation develops, it will be essential for authorities to ensure that similar breaches do not occur in the future, reinforcing the importance of compliance with data protection laws and regulations.
