The GDPR Enforcement Problem
The European Commission confirmed it will not act on the alleged data leak. A spokesperson explained that GDPR does not apply in the non-government-controlled areas of Cyprus because the acquis has been suspended there. In practical terms, this means 350,000 people lost EU data protection the moment their data was stored in a territory the EU doesn’t officially recognize.
It’s a straightforward but devastating loophole: no political recognition equals no GDPR enforcement, regardless of the scale of the breach.
What Data Was Exposed
The breach, first reported on January 8 by Yeniduzen newspaper, affected 364,036 individuals. The exposed data includes:
- Full names
- Identity card numbers
- Passport numbers
- Vaccination records
Cybersecurity experts in the Netherlands confirmed the files are easily accessible on the dark web. They warned this dataset creates direct risk for fraud, identity theft, blackmail, and stalking. The exposed information is highly sensitive and immediately usable for criminal purposes.
How the Breach Happened
The source was identified as the Adapass system, which generated Covid-19 vaccine certificates for Turkish Cypriot authorities. The system stored personal data in a local database and generated scannable QR codes for both digital and physical vaccination proofs. No indication has been given that the system had proper security protections, and how the data leaked to the dark web remains unclear.
Local Protection Laws Are Outdated
Without EU oversight, Turkish Cypriot authorities must rely on their own data protection laws. Here’s the problem: the existing legislation dates back to 2007 and has never been updated.
A personal data protection board was established in 2019 to monitor implementation, but its enforcement power is almost nonexistent. The penalties haven’t changed since 2007 either. The maximum fine the board can impose is 3,000 Turkish Lira, currently worth only €55.13. Courts can go higher, up to 15,000 Turkish Lira (€275.63) or up to five years in prison, but these figures are meaningless in a real data breach scenario.
The Response: Investigation and Vague Promises
North Cyprus’s public works minister Erhan Arikli stated authorities are investigating. He also claimed the telecommunications department largely prevents these things without publicizing them too much
, which is precisely the kind of statement that destroys public trust when a breach of this scale has already occurred.
No timeline has been given for the investigation or any accountability measures.
Cybersecurity experts are calling this a high-level security crisis
, not an ordinary breach. The exposure of vaccination records, identity documents, and passport numbers creates cascading risks for hundreds of thousands of people. The fact that the EU can simply decline to act because of a political recognition issue shows how fragmented data protection becomes once you step outside recognized jurisdictions.
For the 350,000 affected individuals, the message is clear: their data protection depends entirely on which government officially recognizes their territory, not on the strength of their personal information or the severity of the breach.
Follow Hashlytics on Bluesky, LinkedIn, Telegram and X to Get Instant Updates
