VavaCars, the popular car buying and selling platform in Turkey, was subjected to a cyber attack. The platform reported that the data of more than 32 thousand people was stolen. Along with company employees, users were also affected by the attack.
Personal Data Protection Authority (KVKK), popular fast vehicle sales platform in Turkey VavaCars He made an important statement regarding. In the statement, it was stated that there was a data breach in VavaCars systems. Data breach affecting platform employees and users, 32 thousand 589 people Impressed.
According to the information contained in KVKK personal data of customers has been seized. The captured data included names, phone numbers, e-mail addresses, IBAN numbers and general information about users’ vehicles, plates and VIN codes are included.
KVKK’s statement is as follows:
In summary, in the data breach notifications submitted to the Board by Vava Cars Turkey Automotive Joint Stock Company, which is the data controller;
- Your violation; occurred as a result of an internal user’s credentials being captured and used to access application data,
- Your violation On 31.10.2023 took place and was detected on the same day,
- Number of people affected by the breach 32,589 is,
- Relevant groups of people affected by the breach include employees, userssubscribers/members, customers and potential customers,
- Categories of personal data affected by the breach;
- Name, address, phone number, email, IBAN, bank information price, VIN, plate number and customer data provided when purchasing a car, including vehicle information
- r including name, address, phone number, email, appointment date, center name and license plate number.provided for andevu customer data
- Including name, email, phone number, address, contact name dealer data
- Including customer name, email, phone number customer data
- Including name, address, email, city, manager name warehouse data
- Starting price, reserve price, buy now price, total cost, vehicle details tender details including
is
- Relevant persons can receive information about the personal data breach from the data controller via e-mail and call center.
information is included.
Although the investigation on the issue continues, with the Decision of the Personal Data Protection Board dated 09.11.2023 and numbered 2023/1927, it was decided to announce the data breach notifications on the Authority’s website.