Turkish online stores via a shared e-commerce provider (Eve Kozmetik, Shaya, Deniz Butik, Samsonite Turkey, Elle Shoes and others) data breach

What happened

Between September 16 and October 27, 2026, Turkey's data protection authority (KVKK) published breach notices from dozens of Turkish online stores whose customer data sat with outside e-commerce service providers; 29 of the notices say attackers exploited a flaw in a third-party software library on the provider's server or that the provider reported the breach to the store on September 10, 2026. The provider is not named in the notices, and some stores give different details, so more than one provider may be involved. Counts are per store and may overlap: Eve Kozmetik 6,263,305 customers, Shaya (Alshaya brand stores) 2,298,726, Deniz Butik 1,271,096 and Elle Shoes 270,524, while Samsonite Turkey and several others had not yet determined a number; the 6,263,305 figure shown here is the largest single store's count, not a total. Depending on the store, the data includes names, email addresses, phone numbers, postal addresses and stored or hashed account passwords; no notice in this group mentions card numbers.

What should I do?

1. If you reused the password from one of these store accounts anywhere else, change it on those other sites and turn on two-step verification.
2. Change your password at the affected store the next time you sign in.
3. Expect SMS and email scams that use the store's name, such as fake order, cargo-delivery or refund messages; do not tap links in them, and go to the store's site or app directly.
4. Use the contact listed in each KVKK notice (for example kvkkbildirim@eveshop.com.tr for Eve Kozmetik) to ask exactly what data the store held about you.

Check the other services you use →