A Turkish journalist is sounding the alarm after uncovering a massive data breach that has put the personal data of all Turkish citizens, including deceased individuals, at risk.
The data of more than 101 million people stored in government databases is now allegedly being exploited by organized crime groups.
The security breach was first discovered in 2022 and allows access to sensitive information such as phone numbers, ID details, addresses, property data and health records.
However, the initial reports from 2022 suggested a one-off leak of outdated information, while the new revelation shows the extent of the vulnerability of personal data stored by the government and illustrates how criminal groups have instant access to government databases in real time.
In a video posted on his YouTube channel, investigative journalist Cevheri Güven showed how the data is being accessed and which two specific websites are selling not only access to the data but also weapons, drugs, credit card information and more, revealing the extent of cybercriminal activity surrounding this massive data leak.
YouTube twice removed Güven’s video because it exposed people’s personal data, as it showed how easy it was to obtain personal information on the websites that provided access to the e-government database. Güven uploaded the video to X instead of YouTube, where it was retweeted more than a thousand times and viewed by tens of thousands.
Güven revealed that the intrusion was into the Ministry of Health’s public health management system. The hackers used a virus hidden in unlicensed software installed on a doctor’s computer to infiltrate the system.
According to Güven this tactic worked because of a broader pattern of vulnerabilities caused by the frequent use of pirated software in Turkish government institutions as well as unlimited access to all data by members of the civil service.
Güven points out that the data is now accessible through criminal online marketplaces. These marketplaces offer paid subscriptions that allow individuals to query official government databases and access up-to-date information. This has significantly increased the security risk since criminal networks can access government systems directly and in real time.
According to Güven, the marketplaces have access to the security keys of hundreds of members of the civil service as a backup.
The consequences of the intrusion are far-reaching and pose a serious threat on multiple fronts.
Criminals could threaten individuals by exposing their sensitive personal data.
The detailed personal information also provides a basis for identity theft and related fraudulent activities.
In addition, foreign governments and non-state actors could use the stolen information for espionage or targeted attacks.
While some individuals involved in the use of the stolen data have been detained, Güven criticizes the Turkish authorities for failing to address the root causes of the data breach, particularly the use of unlicensed software.
Güven points to the repeated calls by cybersecurity experts for state institutions to use licensed programs, introduce stricter restrictions on user rights and implement two-factor authentication systems.