Turkish citizenship database (MERNIS) leak

In April 2016, a 6.6 GB database containing the personal records of 49,611,709 Turkish citizens was dumped in cleartext on a website hosted outside Turkey — an exposure covering nearly the entire adult population of the country and one of the largest national-ID leaks in history.

What happened

The leaked file was a PostgreSQL dump drawn from MERNIS (Merkezi Nüfus İdare Sistemi), Turkey's Central Civil Registration System maintained by the Ministry of Interior. The records corresponded to citizens eligible to vote in the 2009 local elections. Each row contained a TC Kimlik No (national identity number), first and last name, mother's and father's names, gender, city of birth, date of birth, the city and district of ID registration, and a full residential address.

The dump was distributed via torrent and a dedicated .onion/mirror site beginning on 3 April 2016. The site framed the release as politically motivated, taunting the Turkish government over its data-security practices and reproducing the same fields for President Recep Tayyip Erdoğan and other officials.

Verification

Independent confirmation came quickly. The Associated Press ran ten non-public Turkish ID numbers against the dataset and matched eight to the correct names, establishing that the data was genuine rather than fabricated or recycled marketing.

Impact

• 49.6 million citizens had immutable identity data — national ID numbers, parentage, birth details, and home addresses — published in plaintext, freely downloadable.
• Because a TC Kimlik No cannot be changed, the exposure created a permanent foundation for identity theft, financial fraud, and impersonation that no password reset could remediate.
• The data has continued to circulate for years on forums and Telegram channels, feeding later Turkish breach ecosystems.

Official response

Turkish authorities largely minimized the incident. Then–Communications Minister Binali Yıldırım characterized it as an "old story" recycled from a 2010 episode in which officials had allegedly been selling registry fragments. The Justice Ministry opened an investigation, but no perpetrator was ever publicly identified and no remediation was offered to affected citizens.

Why it matters

The MERNIS leak is the foundational Turkish data-breach event: it demonstrated that a single centralized civil-registration database, once exfiltrated, can compromise an entire nation's population permanently. It also previewed a recurring pattern in Turkey — large government-held datasets leaking, official denial or minimization, and no accountability — that would repeat with the e-Devlet breaches years later.