Personal Data Protection Board Declared a Data Breach at Uludağ Elektrik Including 899 Thousand Queries

Personal Data Protection Authority published a public announcement regarding the data breach that occurred at Uludağ Elektrik Dağıtım AŞ.

The relevant provision of the law states: "In case the processed personal data is obtained by others through illegal means, the data controller shall notify the relevant person and the Board of this situation as soon as possible."

Dataset Detected on Dark Web

In the notification sent to the Board by Uludağ Elektrik, it was stated that the violation occurred on 05.08.2025 and was detected on 18.08.2025.

In the statement, "A data set containing information about data controller subscribers has been detected on a platform used by threat actors for file sharing on the dark web."

It was reported that the data set in question contained a total of 57 data categories, including mostly technical data about a subscriber, such as subscriber number, name-surname, partial address, consumption information and meter information, but also personal data, and it was determined that the data overlapped with the records kept in the company system.

Illegal Login to SMS Verified System

Regarding the root cause of the breach, it was stated that it was evaluated that the system, which can only be accessed with the username, password and SMS verification code that must be received at each login, was illegally entered by malicious threat actors.

It was stated that the exact number of people affected by the violation could not be determined, but the number of queries made was 899 thousand 890.

Şirket, ilgili kişilerin veri ihlali hakkında bilgi almak için dpo@uedas.com.tr e-posta adresi üzerinden iletişime geçebileceğini duyurdu.

Announcement Decision from the Board

It was announced that with the Decision of the Personal Data Protection Board dated 25.12.2025 and numbered 2025/2443, it was decided to announce the data breach notification on the Authority's website.

Kaynak: Beykozun Sesi