e-Devlet (e-Government Gateway) data breach

Beginning in June 2023, the personal records of an estimated 85 million Turkish citizens and residents — effectively the country's entire population — were found being sold online after being harvested from e-Devlet, Turkey's central e-Government Gateway.

What happened

e-Devlet is the single sign-on portal through which Turks access thousands of public services: tax records, health data, property and vehicle registration, education credentials, and judicial records. Reporting that surfaced on 9 June 2023 revealed that a site called sorgupaneli.org was offering Turkish citizens' private data in exchange for a free membership signup, with "premium" tiers promising more sensitive fields. The operators boasted they could supply the records of high-profile figures, including President Recep Tayyip Erdoğan, opposition leader Kemal Kılıçdaroğlu, and former president Abdullah Gül.

The exposed fields went far beyond static identity data. They included national ID numbers, phone numbers, home addresses, family-member links, education and health records, banking credentials, tax status, and property details — and, critically, the data was being updated in near real time, indicating ongoing unauthorized access to live government systems rather than a one-time dump.

Impact

• An estimated 85 million people exposed — described in reporting as the most extensive data breach in Turkish history.
• Because the data was continuously refreshed, victims could not "age out" of the exposure; queries returned current addresses and phone numbers.
• A thriving data-brokering ecosystem emerged, with records sold for as little as 100 Turkish lira through panel websites and Telegram groups.

Official response

For more than a year, Turkish authorities denied or stayed silent on the breach. The turning point came on 12 September 2024, when Transport and Infrastructure Minister Abdulkadir Uraloğlu became the first senior official to publicly confirm that citizens' data had been stolen from e-Devlet during the COVID-19 pandemic, contradicting earlier government reassurances.

Why it matters

The e-Devlet breach showed how a centralized digital-government platform becomes a single point of catastrophic failure. Unlike the 2016 MERNIS leak, which was a static snapshot, e-Devlet's data was live and self-refreshing, turning the breach into a persistent surveillance and fraud utility. The episode — official denial followed by belated confirmation, with no remediation for citizens — became a defining argument in Turkey's debate over data-protection enforcement and a 2025 cybersecurity law criticized as a censorship tool.