Loading story…
Turkish restaurant chain Baydöner suffered a data breach that exposed customer information and was later advertised on a public hacking forum. Reporting on the incident said the breach affected up to 3.7 million customer records, while breach-tracking data identified more than 1.2 million unique email addresses in the exposed dataset.
The compromised information included names, email addresses, phone numbers, cities of residence, and plaintext passwords. A smaller subset of records also contained Turkish national ID numbers and dates of birth. Baydöner said in its disclosure notice that payment and financial data were not impacted by the incident.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Have I Been Pwned cataloged the Baydöner breach and summarized the exposed data types and scale of the incident. Its entry noted more than 1.2 million unique email addresses in the exposed dataset.
In March 2026, Turkish restaurant chain Baydöner experienced a data breach affecting customer data. Baydöner later stated that payment and financial information was not impacted.
Details of the Baydöner breach were publicly posted on a hacking forum, leading to reporting that millions of customer records were exposed. The leaked data included over 1.2 million unique email addresses along with names, phone numbers, cities, plaintext passwords, and for some records Turkish national ID numbers and dates of birth.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
French telecommunications provider **Bouygues Telecom** disclosed a cyberattack that led to the exposure of nearly **6.4 million customer records**, including **5.7 million unique email addresses**. The compromised data reportedly included names, physical addresses, phone numbers, dates of birth, and **IBANs**, raising concerns about fraud and financial abuse. The company said affected customers were notified after detecting the intrusion into its services. French electronics retailer **Boulanger** also suffered a major breach in which more than **27 million rows of data** were exposed, including **2 million unique email addresses**. The leaked information reportedly included names, physical addresses, phone numbers, and even **latitude and longitude** data. Unlike the Bouygues incident, the stolen Boulanger dataset was later posted publicly on a hacking forum, significantly increasing the likelihood of downstream misuse, phishing, and identity-related abuse.
Jun 29, 2026
French retailer **LDLC** disclosed a breach affecting customers of its physical stores after stolen data was advertised for sale on a hacking forum. The exposed dataset reportedly included **1.26 million unique email addresses** along with customers' names, phone numbers, and physical addresses, indicating broad exposure of personally identifiable information tied to retail transactions. Emirati retailer **LuLu** also suffered a customer data breach in which an initial set of about **190,000 email addresses** and linked phone numbers was shared on a hacking forum. The incident escalated when the threat actor later leaked a larger backup from **October 2022**, exposing an additional **2.6 million unique email addresses** as well as names, physical addresses, order data, and **`PBKDF2` password hashes**, significantly increasing the risk of account compromise and follow-on phishing or fraud.
Jun 29, 2026
Basic-Fit disclosed a breach affecting about **200,000 customers in the Netherlands** after unauthorized access allowed attackers to download personal data before the intrusion was stopped. The exposed information included membership details, names, addresses, email addresses, phone numbers, dates of birth, and **bank account details**. The company said it notified affected customers and reported the incident to the Dutch Data Protection Authority, while media reports indicated the wider impact may extend beyond the Dutch customer base and raised questions about controls that failed to prevent large-scale data exfiltration. Booking.com also warned customers that unauthorized third parties may have accessed reservation-related information after suspicious activity was detected on a number of bookings. The potentially exposed data included customer names, email addresses, phone numbers, and other booking details submitted during the reservation process. Booking.com said the full scope of the incident remains under investigation, reset PIN codes tied to affected reservations, and urged customers to watch for suspicious activity and phishing attempts leveraging the stolen information.
Jun 29, 2026