Data Breach Report - Defacto Retail Trade Co.

As a result of the examination conducted following the data breach report submitted to the Authority, a breach report was published about Defacto Retail Trade Co. It has been determined that Defacto Retail Trade Co. committed a data breach on 22.09.2023 by the Personal Data Protection Authority. The decision is as follows:

"As is known, paragraph (5) of Article 12 titled 'Obligations Concerning Data Security' of the Personal Data Protection Law No. 6698 is the provision that 'In cases where personal data is obtained by others unlawfully, the data controller shall inform the data subject and the Board as soon as possible. The Board may announce this situation on its internet site or by any other method it deems appropriate.'

In the data breach notification sent to the Board by the data controller Defacto Retail Trade Co., it is summarized as follows:

• Notification that personal data belonging to individuals was viewed on their profile pages and the breach was detected on 14.09.2023,
• The data controller obtained services from a data processor to provide CDN consumption traffic to end-users of customer content,
• It is after the software version including a series of improvements made for the purpose of improving the services offered by the data processor was put into operation that the data breach occurred,
• The categories of personal data affected by the breach are identified as identity, contact, and customer transaction data,
• While some of the 1337 customers who visited the Account Information screen only view their own account information screen, it is stated that some customers could see the information of other customers on the interface of the account information screen, and it is estimated that 2686 people were affected by the breach."

It is stated that the investigation regarding the matter is ongoing, and it has been decided to announce this data breach report on the Authority's website.