Last updated: 2026-09-07
A ransomware recovery plan can restore files and replace passwords. It cannot make previously disclosed biological information private again.
When biometric or genetic data may be involved, organizations need to investigate what happened to the information, assess the consequences for people, and reconsider how those records are collected and protected. Getting systems online is only one part of recovery.
For IT, HR and compliance teams, the practical priority is to connect forensic evidence with decisions about access, notification and continuing exposure.
On 2 September 2026, Türkiye’s Personal Data Protection Authority published a breach notification concerning Yapı Merkezi İnşaat ve Sanayi Anonim Şirketi. It summarizes the controller’s report, rather than final forensic findings:
The notice does not specify the biometric modality, genetic records, prior encryption at rest, entry vector, attacker or ransomware family, production versus archival origin, detailed remediation, or completed individual notifications. It says individuals can request information by email.
As of this article’s update, our review found no subsequent official confirmation of exfiltration or published final findings. Decision 2026/1914 authorized publication while examination continued; it is not a final liability ruling.
Accordingly, the notice does not establish that fingerprints, DNA sequences or every listed category were stolen from every affected person.
Ransomware can make information unavailable. Exfiltration means information has been transferred out of the organization’s environment. Either can occur without the other, and both can occur during one attack.
An attacker’s claim deserves investigation, but is not sufficient proof of which records were copied. Equally, a lack of visible publication does not establish that no copying occurred.
Use three distinct questions in the response:
Restoring a backup addresses availability. It does not retrieve an attacker’s copy or prove that restored records are trustworthy.
Biometric, genetic and health data are special categories of personal data under Article 6 of Law No. 6698. Their lawful processing and protection require particular attention.
However, these categories should not be treated as interchangeable.
A password is a replaceable secret. A fingerprint or facial characteristic is not something its owner can simply reset.
Biometric systems may store captured images or derived templates used for comparison. A template is not automatically anonymous because it is machine-readable rather than a recognizable image. Its risk depends on its format, protection and use.
A compromised template also does not automatically unlock every system that uses the same person’s biometrics. Compatibility, matching methods, sensor protections and other authentication factors matter. An assessment should avoid both universal-compromise claims and blanket assurances that templates are harmless.
Depending on the dataset, genetic information can reveal health-related characteristics and biological relationships. Some implications extend to relatives who never supplied information to the breached organization.
A limited genetic test report and a broad genomic dataset do not have identical consequences. Specialists should establish what the records actually contain before making claims about disease risk, ancestry or family relationships.
Removing names does not necessarily make genomic information anonymous. Linkage with other information can create identification risks, and confidentiality concerns can persist long after the original reason for collection has ended.
Revocation means stopping a system from accepting a compromised credential. It does not erase an attacker’s knowledge.
For a biometric system, practical options may include disabling the affected enrollment, replacing a linked authenticator, or moving to another authentication method. Some template-protection designs support replacement of a protected template. Re-enrollment should not be assumed to achieve this: the supplier needs to demonstrate how the replacement differs and why the old representation can no longer be used.
For genetic records, there is no equivalent reset. Changing a patient number, withdrawing access or deleting an internal copy can reduce future exposure, but cannot reverse disclosure of the underlying information.
The response should identify which risks can be reduced immediately and which require continuing support and review. Avoid describing a password reset, renewed consent or local deletion as complete remediation for disclosed biological data.
Kooch recommends maintaining an evidence register that separates observations, hypotheses and unresolved questions. This helps technical and privacy teams use the same facts when making decisions.
Start with containment and evidence preservation. Isolate affected systems, preserve relevant logs and forensic material, and document response actions. Coordinate collection with qualified responders so recovery work does not unnecessarily destroy evidence.
Then establish the relationship between compromised accounts and sensitive repositories. Review file access, database queries, export activity, cloud audit records and available outbound-traffic evidence. Examine suspected transfers alongside evidence of file staging or copying. Record gaps in logging explicitly; missing evidence can limit the confidence of a conclusion.
Finally, inspect the actual fields under controlled access. A repository label such as “HR” or “medical” does not answer whether it contains biometric templates, genetic reports or something else. Map relevant records to identifiable people and distinguish active systems from archives, exports and backups.
An authentic sample may establish possession of those records without proving an attacker’s entire claimed volume. Keep the conclusion no broader than the supporting evidence.
Türkiye’s special-category safeguards decision, 2018/10, requires measures including a separate security policy, defined access scope and duration, periodic authorization reviews, prompt removal of access after role changes or departure, and staff training. For electronic environments, it also addresses cryptographic storage, separately secured keys, protected activity logs, security testing and two-stage authentication for remote access.
Translate those requirements into an access review that includes administrators, service accounts and suppliers as well as ordinary users.
For example, a payroll integration should be assessed against the specific fields it needs. Its business purpose should not automatically give it access to the entire underlying personnel repository. Vendor maintenance access should similarly have an identified owner, approved scope and expiry.
These are implementation recommendations, not findings about the controls used at Yapı Merkezi.
Segmentation should limit the routes by which an ordinary workstation or compromised account can reach a sensitive repository. A different folder name is not an effective security boundary.
Review application connections, administrative access and permitted data flows together. Restrict unnecessary connections between general office systems and sensitive databases. Protect backup administration separately, and test restoration from copies that an attacker cannot readily alter.
Include archives in the review. A retired application’s export can contain sensitive information even when it is no longer part of daily operations. Where continued retention is necessary, restrict access and assign an accountable owner.
Encryption applied by an attacker is different from encryption the organization used beforehand to protect confidentiality.
Even legitimate storage encryption has limits. Infrastructure encryption may protect lost disks while providing little protection against an attacker controlling a host or account that can already obtain decrypted data.
For each relevant repository, ask:
The useful conclusion is whether the attacker could obtain readable information. An “encryption enabled” setting alone cannot answer that question. Rotating a key also cannot neutralize plaintext already copied.
Kooch recommends a separate assessment for materially different combinations of data and people. A single organization-wide risk score can hide important differences.
Consider identification and linkage first: can a record be connected to a name, employee number or another exposed identifier? Then assess what someone could reasonably infer or do with that combination.
Potential concerns include targeted deception, disclosure of private health information, discrimination, distress, or misuse of a biometric credential in a compatible system. These are possibilities to evaluate, not inevitable outcomes.
For genetic information, obtain specialist input where the meaning of the records is unclear. Consider familial implications without assuming every relative is legally an affected person or automatically sending them sensitive information.
For biometrics, have the system provider explain applicable protections and replacement options in terms that affected people can understand. Support should follow the actual exposure; a generic instruction to change passwords will rarely explain the whole situation.
Article 12(5) addresses personal data unlawfully obtained by others. Under Decision 2019/10, the controller must notify the Board without delay and within 72 hours of learning of the breach. Missing details may be supplied progressively without delay; late notification requires an explanation.
Affected individuals must be informed as soon as reasonably possible after identification, directly where contact details are available, or through suitable alternatives where they are not. This is distinct from the Board’s 72-hour deadline. A processor must inform the controller without delay.
Record the awareness timeline, evidence, effects and measures. Do not defer notification assessment until the full forensic report arrives. Where facts are uncertain, obtain legal input promptly and document the reasoning. An unconfirmed exfiltration claim alone should neither determine nor dismiss the Article 12(5) assessment; consider all evidence of unlawful obtaining.
Decision 2019/271 requires clear, simple notification covering when the breach occurred, affected data categories, possible consequences, measures taken or recommended, and accessible contact details. Personal and special-category data should be distinguished.
Explain the known scope for the recipient, identify material uncertainty, and avoid presenting every category in a public announcement as applicable to everyone. If the start date is unknown, say so instead of substituting the detection date.
Use a secure follow-up process that does not disclose further sensitive information. Publication by the Authority should not be treated as completion of the controller’s own individual-notification duties.
Recovery should leave the organization with fewer unnecessary copies, tighter access and a tested response process. Kooch recommends recording a named owner and completion evidence for each action:
Keep lessons from the incident in the organization’s risk-management process. A finding is only useful when it changes a control, a decision or an accountable person’s work.
Biometric and genetic data call for a response that goes beyond restoring access. Organizations need to understand what information was involved, what protections held, and what continuing risks people may face.
Kooch’s KVKK/GDPR gap analysis and ongoing compliance services can help connect data inventories, access governance and response procedures with a prioritized improvement plan. Talk to Kooch about reviewing how your organization handles sensitive personal data, with specialist forensic or legal involvement where required.
Sources checked on 7 September 2026. The incident summary describes the public record available at that date. Technical recommendations are a practical synthesis of the materials below; they are not regulatory findings about Yapı Merkezi. US technical and scientific references are used for technical context, not as Turkish legal requirements.
