Pursuant to the commanding provision 12/5 titled Obligations Regarding Data Security of the Personal Data Protection Law No. 6698 (“Law”), following the situation that the personal data processed by the data controller is seized by third parties unlawfully, as soon as possible by appropriate means and It has an obligation to notify the Board of Directors (“Board”).

In summary, in the data breach notification notified to the Personal Data Protection Authority (“Institution”) by Denizli Private Egekent Hospital, which has the title of data controller, and shared on the Institution’s website on October 14, 2022;

• “As a result of the data controller being exposed to a ransomware attack on 10.10.2022, its systems were encrypted and hospital systems could not be accessed,
• The relevant person groups affected by the violation are employees, users, subscribers, students, customers, patients, children, adults in need of protection,
• The categories of personal data affected by the breach are identity, communication, location, personal, legal action, customer transaction, physical space security, transaction security, risk management, finance, professional experience, marketing information, and audio-visual records,
• The estimated number of people affected by the violation is 295”.

You can reach the Data Breach Notification Decision via this link: https://www.kvkk.gov.tr/Icerik/7476/Kamuoyu-Duyurusu-Veri-Ihlali-Bildirimi-Denizli-Ozel-Egekent-Hastanesi