Cybercrime and Cyber Incidents
A company’s e-mail account being taken over, money being transferred on a fake payment instruction, unauthorised access to systems or data being encrypted for ransom are also crimes. In cybercrime cases, we represent your company as the victim and make sure evidence is preserved before it is lost; we also conduct the defence when cybercrime allegations are made against your employees or executives.
What are cybercrimes?
The Turkish Criminal Code treats unlawfully accessing and remaining in an information system, blocking or disrupting a system, deleting or altering data, and misusing bank or credit cards as cybercrimes. Fraud and theft committed through an information system are regulated separately as aggravated forms carrying heavier penalties.
The examples companies encounter most often are fake payment instructions sent by impersonating a supplier or executive, former employees continuing to access systems, and ransomware attacks.
How is evidence preserved in a cybercrime case?
In cybercrime, most of the evidence consists of system logs, e-mail headers and server data, which can be deleted or overwritten quickly. Preserving the records unaltered as soon as the incident is noticed, taking forensic images with forensic IT specialists where necessary and applying promptly to the public prosecutor directly affect the chances of identifying the perpetrators.
Scope
- Handling the company’s complaint and intervention as a victim of crime
- Preserving evidence together with forensic IT specialists
- Defending employees and executives facing cybercrime allegations
- Managing the incident together with notification obligations under the KVKK and cybersecurity legislation
How We Work
- Initial assessment of the incident and identifying what must be done to preserve evidence
- Securing the records together with the IT team and forensic IT specialists
- Filing a criminal complaint with the public prosecutor and following the investigation
- Pursuing recovery of the money through the banks and by legal means
- Managing parallel obligations, such as personal data breach notification, at the same time
Team
Frequently Asked Questions
We sent money on a fake payment instruction. What should we do?
Notify the sending and receiving banks immediately, preserve the e-mail and system records, and file a criminal complaint with the public prosecutor without delay. The first hours are critical for having the money frozen; civil and criminal proceedings are then pursued together.
Is it a crime for a former employee to access our systems?
A person whose authorisation has ended accessing or remaining in the company's system may commit the offence of unlawful access to an information system. If they copied data, offences relating to personal data or trade secrets may also arise. Closing access immediately in exit processes prevents these risks.
Should we pay the ransom in a ransomware attack?
This is a decision that must be assessed from legal, technical and commercial perspectives together; payment does not guarantee that data will be recovered or not published. In every case, the incident should be reported to the public prosecutor, evidence preserved and the personal data breach notification obligation assessed within the time limit.
Should a cybercrime and a personal data breach be managed together?
Yes. A cyber attack is often both a crime and a personal data breach under the KVKK. The criminal complaint, the breach notification the Board expects within 72 hours and notifications to data subjects must be consistent with each other.
Would you like to discuss this service? Schedule a meeting with us — the first meeting is free of charge.
Schedule a meeting