Incident Overview

A threat actor operating under the handle "888" claims to have breached Menulux, a Turkish point-of-sale (POS) platform. According to the post on BreachForums, the data breach occurred in January 2026 and resulted in the exposure of approximately 93,000 customer records. The threat actor states the compromised data includes full names, phone numbers, and physical addresses.

The leaked sample data shows Turkish customer records with fields including customer ID (KODU), customer number (MÜSTERİADI), phone number (TELEFON), mobile phone (CEPTELEFONU), email (EMAİL), address (ADRES), tax office (VERGİDAİRESİ), and tax number (VERGİNUMARASI). The addresses in the sample indicate customers from various Turkish cities including Istanbul neighborhoods such as Esenyurt, Küçükçekmece, and Bayrampaşa. The download is gated behind a points system on the forum.