Why Did Imamoglu Take Istanbul’s Resident Data—And Who Got Their Hands on It?

Suspended Istanbul Mayor Ekrem Imamoglu is facing a series of serious charges, including obtaining and leaking residents’ personal data to private companies.

Investigators have brought seven major accusations against him, ranging from leading and participating in a criminal organization to severe fraud, bribery, unlawful data acquisition, bid rigging, favoritism, and abuse of public office.

Turkiye was shaken by a political earthquake on March 19, 2025, when police raided Imamoglu’s home and arrested him on corruption and terrorism-related charges. The arrest triggered a high-profile investigation involving other municipal officials.

Data leaks have long been a source of controversy in Turkiye. In 2016, during the attempted coup, sensitive information—including details about President Recep Tayyip Erdogan—was exposed. In 2024, a massive data breach revealed personal records of all Syrians in Turkiye, a case still tied up in court.

This time, however, the stakes are even higher. The leaks allegedly came from a man once seen as the opposition’s leading presidential contender, along with a network of municipal officials. The revelations have escalated concerns over national security, making the case one of the most explosive in recent years.

Leaked Audio 

During his testimony, Ekrem Imamoglu was confronted with a leaked audio recording revealing that personal data of millions of Istanbul residents had been illegally sold to private companies through fraudulent tenders.

According to the recording, the data was collected by Reklam Istanbul through illegal contracts and funneled via Medya A.S, a municipal subsidiary, between 2022 and 2024.

The owner of Reklam Istanbul, Mustafa Nihat Sutlas, is a close associate of Murat Ongun, the Istanbul Municipality spokesperson and chairman of Medya A.S. Ongun, a key ally of Imamoglu, is responsible for orchestrating his media campaigns.

The leaked audio, reportedly provided by a confidential witness, suggests that Ongun was the real financier behind the data collection, further fueling suspicions of abuse of power within the municipality.

How Was the Data Leaked?

Turkish media reports indicate that vast sums of money, with undisclosed figures, were funneled to Reklam Istanbul through 73 rigged tenders, particularly under direct procurement deals—circumventing municipal bidding laws. This raises serious concerns about transparency in public fund management and data security.

One of the most alarming moments in the recording features an individual saying: “If they find out we have all of Istanbul’s data, it will be a disaster for us.”

Another voice adds: “I’m not just using this data for financial gain; I see it as a political investment too.”

Prosecutors have launched an investigation to determine whether the data was sold or leaked to foreign entities, including suspect organizations or extremist groups—fears that have surfaced before regarding the security of sensitive personal information.

In 2024, the year the data breach reportedly occurred, Istanbul’s population reached 15,701,602, surpassing the populations of 131 countries, according to Turkish Statistical Institute and UN Population Fund data. The scale of the leak underscores the grave security risks posed by such breaches in a metropolis of this magnitude.

National Security at Risk? 

The data leak scandal in Istanbul has sparked intense debate among Turkish politicians and journalists. Prominent columnist Ibrahim Karagul took to X to issue a stark warning: “This is espionage [..] This is a national security issue!”

He questioned whether the leaked data had been handed over to Mossad (Israel’s intelligence agency) or the PKK (Kurdistan Workers' Party), raising concerns about potential foreign involvement.

Karagul alleged that Istanbul’s digital infrastructure, including the municipality’s transportation card system, was exploited to track citizens and steal their personal information. “They used this data for political purposes and had plans to leverage it further,” he wrote.

He likened these tactics to those of FETO (the Fethullah Gulen organization, designated a terrorist group in Turkiye) and Mossad, stating that such methods had been used before. According to Karagul, intercepted phone conversations revealed that Akbank was also involved in facilitating the scheme.

Karagul further claimed that data from Istanbul’s municipal apps, including the mobile platform Istanbul Senin (Istanbul is Yours), had been copied immediately after the elections, affecting nearly 16 million residents. He suggested that the perpetrators weren’t just targeting Istanbul—they planned to scale up and seize the personal data of all Turkish citizens.

“Do not use any digital products linked to the Istanbul Municipality, including its transportation card—cancel them immediately.”

Turkish journalist Nedim Sener echoed growing concerns over the Istanbul data scandal, urging citizens on X to log out of all IMM (Istanbul Municipality) digital applications, including the Istanbul Card.

He highlighted a shocking admission: “Murat Ongun confirmed that they copied the personal data of all Istanbul residents for political purposes—and they plan to do the same for all of Turkiye.”

Sener further revealed that users who interact with certain online ads could unknowingly have their personal data matched with surveillance cameras through a tracking system purchased as part of Ekrem Imamoglu’s political project.

“Take just a few minutes to understand why I call this a national security issue [..] You won’t believe your ears.”

Syrian Data Leak Sparks Alarm in Turkiye

The Istanbul data breach has revived memories of another major leak in 2024, which exposed the personal information of millions of Syrians living in Turkiye.

On July 4, 2024, more than 3 million Syrians were stunned to discover their official records leaked on a Telegram channel operated by an anonymous group. The exposed files included data on temporary protection cardholders, residency permit holders, and naturalized Syrians, revealing national ID numbers, parents’ names, birthplaces, addresses, and even passport scans.

At the time, this massive security lapse triggered fear among Syrians, who were already facing political and social hostility from opposition groups. Many worried that their data could be exploited for fraud, harassment, or even deportation campaigns.

Turkiye Interior Ministry later traced the breach to a Telegram group called “Turkiye Uprising,” astonishingly run by a 14-year-old boy. Interior Minister Ali Yerlikaya confirmed that the leaked data dated back to before September 8, 2022, and ordered a full-scale investigation to determine the source and scope of the breach.

Turkiye’s Data Leaks

Data breaches have long been a recurring crisis in Turkiye, with one of the most severe incidents occurring on April 6, 2016. The Turkish Ministry of Justice launched an investigation into the online leak of a massive national database containing the personal information of 50 million Turkish citizens, including President Recep Tayyip Erdogan.

The leaked data was allegedly stolen from Turkiye’s Population Bureau. At the time, Prime Minister Ahmet Davutoglu vowed to take necessary measures to protect citizens’ information, emphasizing that “a regular citizen’s data is as important as my own as Prime Minister.”

Justice Minister Bekir Bozdag suggested that the breach might have originated from the Supreme Electoral Council (YSK). However, YSK President Sadi Güven denied any leak from his institution, stating that while the leaked data matched their records, there was no evidence of a breach from their system.

In response, Turkish newspaper Hurriyet called for reforming election laws to prevent political parties from accessing personal data and exploiting leaks for political gain. The next day, on April 7, 2016, the Turkish government passed a long-awaited data protection law, aligning with European Union standards as part of Turkiye’s EU accession efforts.