Five suspects, including the owner and employees of Ankara-based Aydo Yazılım, were detained in an operation targeting cyber spies coordinated by the National Intelligence Organization (MIT) in cooperation with the Cybersecurity Presidency and the Gendarmerie General Command, according to information obtained from security sources,
Aydo Yazılım is a company based in Ankara that provides software services to labor unions.
During searches of the suspects’ homes and workplaces, numerous computers, mobile phones and digital materials were seized.
As a result of intelligence work conducted by MIT, it was determined that a special query interface had been added to some union software developed by Aydo Yazılım, allowing access to information belonging to third parties who were not union members.
Investigations found that data sets previously leaked online from various sources could be queried through the system.
Queries conducted using individuals’ Turkish ID numbers could provide access to identity and population information, while much more extensive personal data was found in the databases operating behind the system.
The query system was found to be used to complete membership information when adding individuals to unions. It was also discovered that the databases contained records belonging to individuals under the age of 18. Following this finding, the investigation into the purposes for which the extensive data pool was being used was expanded.
Examinations of the servers found that the abbreviation “NVI” was systematically used in system records containing personal information, creating the impression that the data originated from the General Directorate of Population and Citizenship Affairs.
However, technical findings obtained during the investigation established that the data had not been directly obtained from the General Directorate of Population and Citizenship Affairs systems.
The investigation also found that Aydo Yazılım provided consultancy services to institutions and organizations under the Personal Data Protection Law (KVKK) through a service called “Clock&Wise.”
The company was found to have provided consultancy on protecting personal data while simultaneously enabling queries of personal information through its union software.
Investigations are ongoing into which unions used the system and to what extent, as well as the purposes for which the data obtained through the system was processed.
