Ransomware and Data-Theft Claims in Türkiye: Q1–Q3 2026

Bottom line

Five findings matter for a board or a CISO in Türkiye, and for any group that supplies or buys from Turkish industry.

1. Türkiye sits between the Gulf and France. We observed 79 Türkiye-linked claims in the first nine months of 2026, split 21, 25, and 33 by quarter. That is just under the 83 across our six Gulf markets and well under France's 185. These are observed volumes in our collection, not a comparable measure of real incidence. The tracker's raw yearly counts, taken before deduplication and on an uneven record in earlier years, are 15 for 2023, 17 for 2024, 52 for 2025, and 88 so far in 2026, so they point up but do not prove a reliable trend.
2. Industry is the target. Manufacturers made 31 of the 79 claims (39%), from machinery and steel to textiles, chemicals, packaging, and automotive suppliers. A vendor's Türkiye report gives a similar share, 38%, on its own counts. Transport and logistics, finance, and healthcare follow with five or six claims each.
3. One leader, a long tail, and a different mix from France. Qilin made 15 claims (19%), well below its 23% share in France. The top six groups made 48 claims (61%), and 17 groups made the other 31, 13 of them with one or two claims. Fourteen of the 23 groups also appear in our French data and made 52 of the 79 claims, while nine, including CRPxO, Deadlock, and Doommageddon, do not.
4. One batch lifts the third quarter. On 31 July a brand called CRPxO listed eight Turkish names at once, including a bank, an insurer, a defense-electronics firm, a retailer, and an airline. Most carry no website in the tracker and the supporting detail is thin. Without them the third quarter would be 25 claims, level with the second, so the rise from 25 to 33 is mostly this batch. We treat the batch as unverified.
5. The forum market trades in identity and government data. One vendor feed lists 146 forum and Telegram posts targeting Türkiye, and the sample we captured from 23 August to 11 October offers millions of rows at a time: insurance data, identity documents, school and healthcare records, and sales of access to government systems. Each listing is a verification task, and we name no victims here.

We rate the risk to Turkish manufacturers, and to transport and logistics operators, as High and rising. For healthcare, finance, and public-sector bodies we rate it Elevated, because a claim there reaches personal data on a large scale. These are our assessments, built on leak-site claims that no one has verified.

1. Scope, and what the numbers can bear

This report covers claims naming Turkish organizations that were published on leak sites between 1 January and 30 September 2026. Claims dated in October are cited separately as a later development. The tracker lists 85 such entries. After removing duplicates and organizations headquartered elsewhere, 79 remain. We removed one entry with no name, one pair of listings for the same group on the same day, and four entries whose domains or profiles point to companies outside Türkiye or that we could not place. We count the same domain or organization name listed again within 14 days, by the same or another group, once. This rule can merge genuinely separate incidents at one organization, so a repeated listing counts as one claim and not as proof of one incident. We attribute an organization to a country by its headquarters or main operations, using its domain and public profile, so a Turkish subsidiary of a multinational is counted when it is listed under its Turkish name and domain. The tracker’s company descriptions are sometimes generated automatically, and we have not verified them. A second tracker we checked lists a few entries the first does not, including a hospital-group claim, and it dates the CRPxO batch differently. Visibility differs by country, so the counts are not complete incident totals.

Three caveats apply to everything below.

• Leak sites, the sites on which groups publish stolen data, show only victims who did not pay or negotiate privately. Real incident counts may be larger.
• A group’s claim is not proof of compromise. We use “claim” for an unverified listing and “incident” only for an established event. We have not independently verified any published dataset, and several brands in this report post claims with little or no evidence.
• Attributing a victim to a country is imperfect, and some Turkish groups operate across borders. We found no official Turkish incident statistics comparable to the counts here, so we cannot set our numbers against a national total. Treat our counts as what we observed, not as a complete tally.

Terms. RaaS: ransomware-as-a-service, a platform that developers rent to independent affiliates. EDR: endpoint detection and response, security software on servers and laptops. Initial access broker (IAB): a seller of ready-made entry into a network. KVKK: the Turkish personal data protection authority and law. “1kk” and “5kk” in forum titles are shorthand for one million and five million rows.

2. Timeline: a steady flow and one spike

The pattern is a steady flow of about nine claims a month, from 4 in January to 10 in March, May, and September, with a spike of 16 in July. Eight of the July claims are the CRPxO batch of 31 July, so without it July has eight, in line with the other months. March is helped by three DragonForce claims on 4 March, and May by three claims on 22 to 24 May from three different groups. In the first six days of October the tracker added three more claims, so the flow has not stopped.

The yearly bars show the tracker's raw 2026 entries already above all of 2025 by early October. They are raw counts before cleaning, not the 79 cleaned claims used in the rest of this report. Because the earlier years were collected more thinly and the counts are not cleaned, we read the bars as a rising signal, not a measured growth rate. We found no Turkish official series on ransomware incidents to set beside them.

3. The groups at a glance

Twenty-three groups made 79 claims. The top six made 48 (61%), and the other 17 made 31, with 13 of those groups posting only one or two claims each. The head is less concentrated than in France, where two groups made 41%, and the leader here, Qilin, holds 19%. A vendor report for Türkiye puts Qilin at 15%, LockBit at 11.9%, and NightSpire at 6.9%. Our LockBit share is much lower, at one claim, which shows how far a group ranking depends on the window and the cleaning rules.

The same groups in Türkiye, France, and the Gulf

Fourteen of the 23 groups also appear in our French data and made 52 of the 79 Turkish claims. At least eight, listed below, also appear in our Gulf data. The table shows the eleven groups with the most Turkish claims.

French and Gulf counts come from our France report, our six Gulf country reports, and the Gulf summary. Read the France report · Read the Gulf summary

4. Who is being hit

Our own classification of the 79 claims, using the tracker’s sector tags and correcting the few we could see were wrong. Each claim is counted once.

Manufacturing leads at 39%, well ahead of technology at 10%. The factory list is broad: machinery and earth-moving equipment, steel parts, textiles, chemicals, packaging, plastics, cosmetics, an automotive importer, and an electrical-equipment maker. Four of the six finance claims belong to the CRPxO batch (three banks and an insurer), as does one of the six transport claims, the airline. Healthcare has five claims from five different groups, and only three claims name a government or defense entity, of which one is a public body, the land-registry agency. Compared with France, where professional services lead and 12 communes appear, Türkiye's list is an industrial one with a few critical services and almost no local authorities.

In the Turkish sample, manufacturing plants predominate: a maker with a factory floor, a supply chain, and export customers waiting.

5. Case files

Counts show the shape of the problem. Individual cases show how it works. Each case below states what was claimed, what the timing and structure suggest, and how far we trust it.

Case 1. Qilin, a steady stream (15 claims)

Claims. From 4 January to 20 September, Qilin posted 15 Turkish organizations, four in Q1, five in Q2, and six in Q3. Five of them sit in manufacturing and two in healthcare, and the rest include a cosmetics brand, a food producer, a law practice, a public university, a technology firm, and two diversified holding groups. A construction firm followed on 6 October.
Reading. The spread of sectors and sizes fits a RaaS brand whose affiliates choose targets by access, not by industry, and Türkiye's large industrial base gives that kind of access plenty to choose from. The ranking is the same as in France, where Qilin is also first, but its share is smaller here. On 9 October the press reported that Japan had confirmed the arrest of a Russian national accused of being a Qilin member. He was detained in Osaka in May and, according to reports, handed over to Germany on 2 October. The reports tie him to attacks on German companies, not to Turkish victims, and we do not read it as a break in activity: Qilin claims continued after the May arrest, and the tracker lists one against a Turkish construction firm on 6 October, four days after the handover.
Confidence. High on the counts and dates. Low on how affiliates pick targets.

Case 2. One day, eight names (CRPxO)

Claims. On 31 July a brand named CRPxO appeared with eight Turkish listings: a grocery chain, a defense-electronics company, an insurer, a media and energy conglomerate, an airline, and three banks. Six have no website in the tracker. A second tracker lists eleven entries: the same eight plus three more, a pharmaceutical group, a car maker, and an automaker's local arm. It dates the batch to 12 August, and gives each entry a templated profile with a city, a sector, a data volume from 0.2 to 4.5 GB, and a deadline of 8 August, which falls before the listing date.
Reading. A single brand posting the best-known names in several sectors in one day, with uniform fields and an inconsistent deadline, looks more like a mass listing built to attract attention than like eleven separate intrusions. That is our reading, not a finding. The volumes are small for companies of this size, and we have seen no confirmation from any named firm. The tracker lists 37 CRPxO victims in all, 26 of them in the United States and eight in Türkiye, so the Turkish batch is not its main business. The batch matters mostly because it inflates the third quarter and because customers and journalists may take such a list at face value.
Confidence. High that the listings exist. Low that any describes a real intrusion.

Case 3. Deadlock and Doommageddon: Türkiye as one market among many

Claims. Two brands account for 11 Turkish claims in our window. Deadlock posted six between 22 May and 19 August: a manufacturer of electrical-equipment parts, an earth-moving machinery maker, two plastics and engineering firms on one day, a medical laboratory, and a port terminal operator. Doommageddon posted five claims within the report window, from 8 March to 28 August, including an automaker's local importer, a chemicals firm, a machinery maker, a real-estate firm, and a logistics firm. On 5 October it added a claim against a school, outside the report window. A handle of the same name also appears among the most active posters in a vendor's Türkiye forum feed, with five posts.
Reading. Türkiye is one market among many for both. The tracker lists 106 Deadlock victims in 42 countries since May, with Italy (12), Spain (11), the United States (7), and Poland (7) ahead of Türkiye (6), and 16 Doommageddon victims, six of them Turkish, followed by India (3) and Brazil (2). Both mostly post mid-sized industrial and logistics names, which fits groups that choose targets by access, not by geography, so Turkish manufacturers should read them as part of a wider European industrial pattern. A port operator and a laboratory sit among the manufacturers, so the pressure reaches logistics and health as well. We hold little technical reporting on either brand, so we do not profile them below.
Confidence. High on counts and dates. Low on who they are and how they get in.

Case 4. Holding groups and the big names

Claims. At least six claims name a holding or large industrial group or a well-known brand: two to Qilin, one each to The Gentlemen (an appliance maker), BlackNevas (a hospitality and casino group), Doommageddon (an automaker's local importer), and a second Gentlemen listing on 7 September. The appliance-maker listing claims thousands of internal documentation spaces and project-tracking projects and says access came from a broker linked to a third-party services provider. The 7 September listing carries a profile of a small packaging group that does not match the name of a large well-known firm, which shows how a generated profile can mislead.
Reading. Holding groups run shared IT across subsidiaries, so a claim against one name can reach sister companies, and a third-party services provider named in a listing is a lead to check, not a proven route. What we would do is ask which shared systems connect a group's companies, and whether a claim against a subsidiary, a supplier, or a services provider could touch yours.
Confidence. High that the listings exist. Low on the access claims, which we could not verify.

Case 5. Health, transport, land registry, and defense

Claims. Five healthcare claims came from five groups: a medical-device maker (Direwolf, 4 January), a private hospital group (Qilin, 15 June), a pharmaceutical firm (Qilin, 23 July), a hospital (Direwolf, 30 August), and a pharmaceutical multinational's local arm (N0n, 18 September). The second tracker also lists a claim against a 36-hospital group from BlackNevas-linked reporting on 12 April, which the first tracker does not carry. In transport, The Gentlemen listed a high-speed-rail company and a motorway operator within five days in February, Deadlock a port terminal operator in August, and CRPxO an airline on 31 July. APT73 listed the land-registry agency on 22 May, and NightSpire a defense supplier on 30 March.
Reading. Several groups are reaching for services where downtime is visible and personal data is large. A hospital or a registry holds data on many people, so a data-theft claim there reaches citizens even without encryption. We do not know what, if anything, was taken, and we have not seen the affected bodies confirm.
Confidence. High that the listings exist. Low on impact, which no source confirms.

Case 6. October already: three claims and a busy forum week

Claims. Between 4 and 6 October the tracker lists three more claims outside the window: Emperador against a hardware manufacturer (4 October), Doommageddon against a school network (5 October), and Qilin against a construction firm (6 October). In the forum feed, listings continue every day, with new items on 6, 7, and 11 October.
Reading. Three different groups in three days, from a school to a builder, fits the broad, access-driven pattern in Case 1 and the local-focus pattern in Case 3. The listings do not change the numbers above.
Confidence. High on the listings. Low on what, if anything, was taken.

6. Active threat actors: presence, motivation, and TTPs

Five selected actors, chosen for relevance to defenders and not by volume, made 37 of the 79 claims and are profiled below. CRPxO, Deadlock, and Doommageddon rank above some of them by count, but we hold too little technical reporting on them to profile (Cases 2 and 3). Their public technical detail comes from global incident reporting, not from the Turkish cases, so read the tradecraft as known behavior of each group in general, not proof of what happened to a named Turkish firm. Technique IDs refer to MITRE ATT&CK.

Four actors with sufficient public technical reporting are shown. Marks reflect public reporting on each group worldwide, not Turkish incident evidence. An empty cell means the technique is not documented in the sources we reviewed, not that the group does not use it. BlackNevas has no column because we hold less public technical reporting on it.

Actor profiles

Other groups worth knowing

• CRPxO (8). The 31 July batch of well-known names, with thin and templated detail. See Case 2.
• Deadlock (6) and Doommageddon (5). Two brands that work Türkiye among many markets (106 and 16 victims worldwide), posting industrial, logistics, and health names. See Case 3.
• Krybit (4). Three manufacturers and a technology firm between April and September, one a month after its first claim. It also works France (6) and the Gulf (6), which makes it one of the few brands in all three markets.
• APT73 (3), INC Ransom (2), Direwolf (2), Nova (2). Brands that appear less often in our sample, with a few claims each, mixing a finance firm, the land-registry agency, manufacturers, a hospital, and a medical-device maker. INC Ransom is far more active in the Gulf (eight claims) than in Türkiye.
• One claim each: Tengu, LockBit 5.0, Payload, AuditTeam, Bravox, Majinahanashi, Dark Project, Barracuda, N0n, and Emperador. LockBit 5.0 has only one Turkish claim against eight in France and six in the Gulf.

7. Beyond the leak sites: forum claims

Ransomware crews post victims on their own sites. Everyone else posts on criminal forums: data sellers, access brokers, hacktivists, and attention seekers. One vendor feed lists 146 Türkiye-targeted posts under its country filter, across forums and Telegram, and we captured the 32 listings it shows with details from 23 August to 11 October. That is enough to show the shape of the market but not to measure it. We name no victims here, because the claims are unverified and naming a target may amplify an unproven claim.

What the market looks like

• Scattered handles. The feed's top five handles account for 25 posts (17%), with seven, five, five, four, and four posts each. Unlike the French market, where one handle makes 9%, no single seller dominates.
• Government and public-service access. The sample includes a listing selling a web shell on a government system, a dataset said to come from a foreign embassy in Türkiye, a maritime-traffic command center, a research-council domain, and a public-service portal. Selling access is different from selling data: it can be used again.
• Identity and consumer data in bulk. Many titles state a record count, for example 11 million insurance rows, a million-row school-safety dataset, and a five-million-record listing, plus 312 passports and 215 vehicle plates. Others offer bank-customer leads, call-center records, betting and gambling sites, a telecom dataset, and healthcare lists. Some are listings of old or aggregated data.
• Repeat posters. Some handles posted several listings in a few days, three each on 16 September and 11 to 12 September for two of them, which suggests a catalog being sold off rather than one breach.

As elsewhere, data published by attackers may come from older leaks or several sources, and victims should qualify it before acting. For a public-sector body, a retailer, or an insurer, that means checking whether a sample matches current records, how old the fields look, and whether the poster is reselling something already public.

Confidence. That the posts exist: high. That each describes a real breach: low. That any maps to a ransomware incident: low. We cannot link any listing to any claim, and we do not.

8. Update outside the report window: October 2026

Between 4 and 6 October the tracker lists three more Türkiye-linked leak-site claims (Case 6), and the forum feed shows new listings on 6, 7, and 11 October, including a Turkish threat-intelligence company posted on the 11th. On 9 October the press reported the Qilin arrest described in Case 1. None of these is in the 79.

9. How they get in

Leak sites show victims, not intrusions, so this section draws on public vendor reporting and on how the listings are worded. The consistent picture:

• Exposed remote access and valid accounts. Vendors describe Qilin and Gentlemen affiliates working through VPN accounts, exposed edge devices, and management tools that blend into normal administration.
• Bought access and stolen credentials. Forum sellers offer records and access cheaply, and the one listing that describes its entry route says access came from a broker. A vendor's Türkiye report cites more than 5,000 compromised users and 82 exposed domains from infostealer data, on its own window and counting.
• Shared group and provider systems. Holding groups and the services providers that run collaboration and project tools hold many companies' files, which is one hypothesis worth investigating among several.
• Data theft without encryption. Several Turkish listings are data-theft claims with no sign of a locked network, and the forum market sells data and access directly.

10. The regulatory frame

Two regimes matter. The Personal Data Protection Law, no. 6698 (KVKK), requires a controller to notify the Personal Data Protection Board of a breach as soon as possible, and the Board’s decision of 24 January 2019 (no. 2019/10) reads that as no later than 72 hours after learning of it, with affected people told as soon as they are identified. In a separate decision of 25 December 2025 (no. 2025/2451), the Board limited the time breach notices stay published on its site to at most 60 days, under the conditions it sets. The Cybersecurity Law, no. 7545, has been in force since 19 March 2025. It applies to real and legal persons and unincorporated entities that exist, operate, or provide services in cyberspace, not only to critical infrastructure, and requires them to report detected vulnerabilities and cyber incidents to the Cybersecurity Directorate (Siber Güvenlik Başkanlığı) without delay. The law sets no number of hours, and a Turkish law firm reports that the implementing regulations had not been published as of July 2026. Failing to report is subject to an administrative fine of TRY 1 million to 10 million, on the 2025 nominal figures, adjusted yearly. We have not checked the regulations of sector regulators, such as the banking and energy authorities, and they may add their own duties. Take legal advice for any specific case. We are not lawyers.

11. Outlook for Q4 2026 and Q1 2027

These are our forecasts, not findings, and each rests on the data above.

1. The flow continues at 25 to 40 claims a quarter. The quarterly record has run 21, 25, and 33, or 25 without the CRPxO batch, and three claims came in the first week of October. This is a qualitative scenario, not a statistical forecast. It assumes broadly stable collection coverage and attribution rules, and a change in either, or another mass listing, would move it.
2. Qilin stays first, with a long tail behind it. Its share is steady across the year and affiliates, not the arrested person, choose targets, so the German extradition is unlikely to change that alone.
3. Deadlock and Doommageddon keep posting. Deadlock listed Turkish firms in every month from May to August, and Doommageddon in March, May, August, and again in October, so expect more Turkish industrial and logistics names from them alongside their other markets.
4. More mass listings of famous names. They are cheap to post and carry little proof, so each one needs qualifying before a reaction, and the more famous the name, the more attention it draws regardless of the facts.
5. Reporting duties under the Cybersecurity Law get clearer. The law is in force, but the implementing rules that would set deadlines and formats were not out as of July, so expect organizations to plan for a short, mandatory report to the Directorate beside the 72-hour KVKK notice.

12. What to do this quarter

1. Start with your network edge. Inventory every internet-facing VPN, firewall, and remote-access gateway. Set a proposed internal target of 48 hours to patch actively exploited flaws, use compensating controls where patching cannot be immediate, and prioritize by confirmed exploitation, exposure, asset criticality, and vendor guidance.
2. Protect the plant. For manufacturers and logistics operators, separate the factory and warehouse networks from office IT, keep offline backups of production systems, and test restoring a line from them. A claim against a factory is a claim against output.
3. Check whether your credentials are for sale. Search infostealer logs, combolists, and broker listings for employee and vendor accounts, change the passwords of accounts whose credentials appear, revoke active sessions, and check for password reuse.
4. Map what your group and your providers share. List the systems that connect your subsidiaries, and the third-party providers that run your collaboration, project, and ticketing tools, then review their access, MFA, and logging.
5. Write down both reporting deadlines. Know who notifies the KVKK Board within 72 hours, who reports to the Cybersecurity Directorate without delay, who briefs the board, and who decides on negotiation. Document it and test it.
6. Qualify claimed data before you react. If your name appears with a record count, check where the data could come from, how old it is, and whether it matches your records, then decide on notification with your data-protection lead.
7. Watch for your organization's name. Leak sites, Telegram channels, and broker forums may carry your data before you learn of a breach. Detection there can buy days.

Sources

• Ransomware.live, Türkiye country statistics and victim records
• RansomLook, group and post records
• SOCRadar, Türkiye Threat Landscape Report 2026
• Köksal Law, Cybersecurity Law No. 7545
• CMS, KVKK limits publication period for data breach notices to 60 days
• The Record, Japan confirms arrest of Russian Qilin operative, extradition to Germany
• Check Point Research, The State of Ransomware Q1 2026
• Proven Data, Qilin attack chain and MITRE ATT&CK TTPs

Sources are linked in their original language. The vendor forum feed we sampled is a commercial service and is not linked.