Cyber Threat Actor: hades_hgs

The threat actoroperates under the alias hades_hgs. Open sources indicate the actor is based in Turkey. On 11 March 2025, the actor launched a cyberattack against TurkNet. The attack specifically targeted TurkNet's customer database. The breach led to the exposure of customers' names. Surnames of affected individuals were also disclosed. Phone numbers belonging to the customers were revealed. Subscription numbers associated with the accounts were leaked. Turkish identity numbers of the users were included in the exposed data. Address details and static IP information were part of the compromised dataset.

The attacker did not access any financial records held by TurkNet. User passwords remained protected and were end‑to‑end encrypted. TurkNet confirmed that the incident caused no interruption to its services. Following the breach, TurkNet increased its technical safeguards. The provider also strengthened its administrative controls. TurkNet notified the Personal Data Protection Authority of the incident. Notification was also made to the Information and Communication Technologies Authority. The company is coordinating with law‑enforcement agencies to identify the perpetrators. This cooperation aims to support any future legal proceedings against the actor.