According to LOG, Turkey's Personal Data Protection Authority (KVKK) said Manisa transport company Manulaş reported that its systems were hit by a ransomware attack on 25 May 2025 and that the incident was detected the same day [1]. The notice quoted by KVKK said about 1,268,222 records were affected, but the number of actual people may be much lower because of duplicate records; data that may have been involved includes names, national ID numbers, contact details, licence plates, photographs and disability-related health information, and it had not yet been determined whether any data was exfiltrated [1][2]. KVKK said people can ask about the incident through the Manulaş website, by phone or by email [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Jun 4, 2025 and we added it on Nov 11, 2026. It is not a new event.
HighMonitoringBackfillMedia reported
Turkish transport firm Manulaş hit by ransomware; KVKK says more than 1.26 million records may be affected
2 min read
- Disclosed
- Jun 4, 2025
- Occurred
- May 25, 2025
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- Scale
- 1,268,222 records[1]
- CVSS basis
- Our assessment
On this page
30-second summary
What happened
Who is affected
Timeline
- Incident publicly disclosed[1]
Technical details
What happened
According to LOG, Turkey's Personal Data Protection Authority (KVKK) published a notice that Manisa transport company Manulaş Manisa Ulaşım Hizmetleri Makina Sanayi ve Ticaret A.Ş. reported a ransomware attack on its systems, which occurred and was detected on 25 May 2025 [1].
Impact
The notice, as quoted by KVKK, said about 1,268,222 subscriber or member records were affected, but because the system contained a large number of duplicate records the number of actual people affected is probably much lower; personal data that may have been involved includes names, Turkish national ID numbers, dates of birth, gender, phone numbers, email addresses, addresses, occupation information, licence plates, photographs, and health information such as disability status and degree [1][2].
The notification said it had not yet been determined whether data was exfiltrated as a result of the attack [1][2].
What to do
KVKK said affected people can ask about the incident through the Manulaş website, by phone, or by email [1][2].
References
Media2
- [1]
“Veri ihlalinden etkilenen kişi/kayıt sayısının 1.268.222 olduğu ancak sistem içerisinde çok sayıda mükerrer kayıt bulunması sebebiyle ihlalden etkilenen gerçek kişi sayısının muhtemelen çok daha az olduğu”
- [2]ShiftDelete.Net2025-06-04Accessed 2026-11-11Snapshot 2026-11-11 sha256 af4ca0838c84
“Veri ihlalinden etkilenen kişi/kayıt sayısının 1.268.222 olduğu ancak sistem içerisinde çok sayıda mükerrer kayıt bulunması sebebiyle ihlalden etkilenen gerçek kişi sayısının muhtemelen çok daha az olduğu”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.