Personal Data Protection Board Declared a Data Breach Affecting 3,700 People in Codeway's "Chat & Ask AI" Application
It was reported that user data was accessed in the "Chat & Ask AI" mobile application belonging to Codeway Digital Services Inc. between January 15-20, 2026 due to an authorization weakness in the Google Firebase infrastructure.
The Personal Data Protection Authority published a public announcement regarding the data breach that occurred at Codeway Digital Services Joint Stock Company.
The relevant provision of the law states: "In case the processed personal data is obtained by others through illegal means, the data controller shall notify the relevant person and the Board of this situation as soon as possible."
Firebase Authorization Vulnerability
In the notification sent to the Board by Codeway, it was stated that the violation occurred between 15.01.2026 and 20.01.2026 and was detected on 20.01.2026.
In the statement, "Due to the weakness in the authorization configuration on Google Firebase services used as the database (Firestore) and file storage (Storage) infrastructure of the mobile application called 'Chat & Ask AI', the attacker or attackers gained access to user data and file pool."
It was reported that the technical weakness was resolved and internal control and audit efforts regarding the data breach are continuing.
Email and Post Contents Affected
Personal data affected by the breach;
It was stated that approximately 3,700 people were evaluated to have been affected by the violation, and studies are continuing to determine the exact number.
Announcement Decision on the Website from the Board
It was announced that with the Decision of the Personal Data Protection Board dated 27.01.2026 and numbered 2026/139, it was decided to announce the data breach notification on the Authority's website.
Kaynak: Beykozun Sesi
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Angry
0
Sad
0
Wow
0
