Turkish Data Breach Notifications (KVKK) Scraper

Every public data breach notification published by Turkey's data protection authority, the Kişisel Verileri Koruma Kurumu (KVKK), as clean, structured JSON: which company was breached, its website, when the breach happened and was detected, what caused it, which personal data was exposed and how many people were affected — with English labels.

The KVKK publishes these notices only in Turkish, as free text, roughly one a day. This Actor turns each one into a record you can filter, alert on and feed into your tools.

Built for threat-intelligence and security teams, cyber insurers, vendor and third-party risk managers, privacy and compliance professionals, journalists, researchers and AI agents.

What you get

Field	Example
publishedDate	2026-09-30
controller	Deve Yükü Dayanıklı Tüketim Malları Limited Şirketi (the company / data controller)
controllerWebsite	https://www.deveyuku.com/
breachDate / breachStartDate / breachEndDate	when the breach happened, when stated
detectionDate	2026-09-24
causeCategories	["unauthorized access", "third-party / data processor"]
causeTr	the cause, as described in Turkish
dataTypes	["name", "surname", "phone number", "email address", "postal address", "login credentials", "order and delivery details"]
credentialsHashed	true when the notice says passwords were hashed
affectedPeople / affectedRecords	133031
affectedCountDetermined	false when the company could not determine the number
affectedGroups	["members / subscribers", "customers", "prospective customers"]
contactTr	how affected people can get information
boardDecisionDate / boardDecisionNo	2026-09-30 / 2026/2137
summaryTr, fullText	the notice's bullet points and full Turkish text
titleEn, summaryEn	optional English headline and summary
url	link to the official notice

Cause categories include ransomware, phishing, social engineering, malware, cyber attack, unauthorized access, account takeover, third-party / data processor, employee / insider, lost or stolen device or documents, misdirected disclosure, and vulnerability or misconfiguration.

How to use it

• Latest breaches — the default input returns the 10 most recent notifications.
• Daily monitoring — schedule the Actor every day with Published from set to yesterday and send new records to Slack, email or your SIEM.
• Vendor risk — put your suppliers' names or domains in Keywords to be alerted when one of them reports a breach.
• Large incidents only — set Minimum people affected, e.g. 10,000.
• English — add your own OpenAI API key for English headlines and summaries. The key is stored as a secret input and is only sent to OpenAI.

Example input

{
  "publishedFrom": "2026-09-01",
  "minAffectedPeople": 10000,
  "keywords": []
}

Coverage

The KVKK website lists roughly the most recent 150 notifications (about the last few months). Run the Actor on a schedule to build a complete history from now on.

The KVKK website usually only answers Turkish IP addresses, so the Actor uses a Turkish residential proxy by default. Its cost is included in the price.

Use with AI agents (MCP)

Works as a tool for AI agents through the Apify MCP server: ask "Has any Turkish company we work with reported a data breach this month?" and let your agent call this Actor.

Pricing

Pay per result: you are charged per notification returned. Use Max notifications and the filters to control cost.

Data source and legal note

All data comes from the official website of the Turkish Personal Data Protection Authority, kvkk.gov.tr, which publishes these notices under Article 12(5) of Law No. 6698 to inform the public. Each record links to the official notice. Fields are extracted automatically and English labels are not official translations; rely on the original notice for legal purposes. A published notice means a breach was reported, not that the company has been found at fault. This Actor is not affiliated with the KVKK.