Learning of a Data Breach from the Attacker’s Announcement

Personal Data Protection Board Decision 2023/1017 of 8 June 2023 shows that how a breach is discovered can be decisive for the sanction.

The controller, which operated digital gaming and entertainment platforms, learned of a cyber-attack not through its own teams but from the attacker’s forum post offering the source code and database for sale. 90,182 people in Türkiye were affected; the Board imposed an administrative fine of TRY 1,500,000. The breach was also notified to the data-protection authorities of fifteen countries.

What drove the penalty was not the breach itself but the manner of discovery: no penetration test had been carried out, the same vulnerability was exploited a second time, and a patch-management policy was introduced only after the incident. A structure that could not spot unusual activity was treated as evidence that logging and monitoring duties had not been met.

The practical reminder is clear: logs, regular penetration tests and a patch policy already in force are the strongest documents that can be put before the Board when a breach occurs. Our briefing is below.