Baydöner baydoner.com Baydöner data breach: what happened and what to do
In March 2026, Turkish restaurant chain Baydöner suffered a breach that exposed over 1.2 million email addresses with names, phone numbers, cities and plaintext passwords. A small number of records also held national ID numbers and dates of birth.
View all 13,115 breaches- Breach date
- 8 Mar 2026
- Affected
- 1,266,822
- Data exposed
- Dates of birth, Email addresses, Genders, Geographic locations, Government issued IDs, Names, Passwords, Phone numbers, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Baydöner is a large Turkish restaurant chain. In March 2026 it suffered a data breach that was then published on a hacking forum, according to Have I Been Pwned (HIBP). HIBP dates the incident to 8 March 2026 and added it on 15 March 2026. It counted 1,266,822 accounts, with over 1.2 million unique email addresses.
Turkey's data protection authority, KVKK, also announced the case. According to Turkish press coverage of that announcement, the unauthorized access began in February 2026, was detected on 8 March 2026, and came through a customer service and call centre platform run by one of Baydöner's suppliers. The regulator put the number of people in the affected database at about 1.5 million.
Claims posted online went further, with a figure of 3.7 million customers, but that number has not been verified. HIBP's count comes from the data itself.
What was exposed
HIBP lists these data types:
- Email addresses
- Names
- Phone numbers
- Geographic locations (cities of residence)
- Passwords, stored in plain text
- Purchases
- Genders
- Dates of birth and government-issued IDs, in a small number of records
The Turkish national ID number is the most serious item. It is used across government services, banking and telecom contracts. Baydöner said in its notice that payment and financial data was not affected.
What this lets criminals do
Plain-text passwords are the first problem. No cracking is needed, so anyone with the data can try your email and password on other sites. If you reused that password anywhere, those accounts are at risk.
Phone numbers and names feed smishing, which is phishing by text. A message that mentions Baydöner or a recent order will look real. Expect texts about a failed delivery, a refund or a "loyalty reward" with a link.
For the small number of people whose national ID and date of birth were included, there is a risk of identity fraud, such as someone using those details to open services or pass a verification check. A national ID can't be changed, so watch for unexpected activity in your accounts and contracts.
The company's response
Baydöner published a disclosure notice. It warned customers that personal data may have been affected through a security incident on its supplier's systems, said payment and financial data was not affected, and advised changing passwords. Look for the notice on the company's own site rather than on links sent in messages.
What to do with what can't be changed
The password is the part you control. Change it everywhere you used it. For identifiers that can't change, such as a national ID and date of birth, the best defence is attention: be suspicious of anyone who knows them and asks you for more.
What to do if you were in it
- 1
Change your Baydöner password, and any you reused
Change it on Baydöner first, then on every other account that used the same or a similar password. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey where the site offers one. It stops most account takeovers even when a password has already leaked.
- 3
Expect texts and calls about orders
A message about a delivery, a refund or a reward that links to a page asking for card details is a scam. Open the Baydöner app or site yourself instead.
- 4
Guard your national ID and date of birth
If your ID number may have been included, be wary of any caller who already knows it and asks for more. Check your accounts and contracts for services you didn't set up.
- 5
Treat messages that mention the breach as suspect
Expect emails and texts that quote your name or details to look convincing. Don't click links in them; open the company's site yourself. Our guide to stopping spam emails helps with the flood.
- 6
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the Baydöner data breach?
Look up your email on Have I Been Pwned. If Baydöner is listed, your email and the other data in the entry were exposed.
What was exposed?
Email addresses, names, phone numbers, cities, plaintext passwords and purchase data. A small number of records also held national ID numbers and dates of birth.
Was payment data exposed?
Baydöner stated in its disclosure notice that payment and financial data was not affected.
Should I change my password?
Yes. The passwords were stored in plain text. Change it on Baydöner and anywhere you reused it, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
