May 29, 2026, 7:03 p.m.

Cyber Attack Statistics in Turkey 2025: Most Targeted Sectors

In today's rapidly digitalizing world, Turkey is increasingly appearing on the radar of cyber attackers. As of 2025, our country ranks at the top of the target list for organized crime groups and state-sponsored APT (Advanced Persistent Threat) groups due to both its geopolitical position and economic potential. Data published by the Information and Communication Technologies Authority (BTK), National Cyber Incident Response Center (USOM), and Cyber Incident Response Team (SOME) clearly reveal Turkey's cybersecurity landscape.

In this comprehensive analysis, we will examine in detail the current statistics of cyber attacks targeting Turkey, the most targeted sectors, common attack vectors, and APT groups threatening our country.

Turkey Cyber Attack Statistics 2025: Overall Picture

According to the latest data published by USOM, more than 250,000 cyber incidents are detected daily on average in Turkey. This figure represents a 37% increase compared to 2024 and shows that our country's exposure rate to cyber threats is above the global average.

Analyses conducted under BTK and SOME coordination reveal that the complexity level of cyber attacks and the rate of targeted attacks have also increased significantly. According to data detected in the first quarter of 2025:

• 42% increase in ransomware attacks
• 28% increase in DDoS (Distributed Denial of Service) attacks
• 51% increase in data theft attempts
• 33% increase in social engineering-based attacks
• 19% increase in critical infrastructure-targeted attacks

These statistics clearly demonstrate that Turkey needs to increase its cybersecurity investments and raise awareness at the corporate level.

Most Attacked Sectors: Detailed Analysis

1. Finance and Banking Sector: Primary Target

31% of cyber attacks in Turkey are directed at the finance and banking sector. According to BDDK (Banking Regulation and Supervision Agency) reports, in 2025, banks and fintech companies faced more than 47,000 serious cyber attack attempts.

Prominent threats in this sector include:

• SMS fraud and smishing attacks: The most common threat targeting mobile banking users
• ATM malware: Increase especially in jackpotting attacks
• Man-in-the-Middle (MitM) attacks: Advanced techniques targeting online payment systems
• Credential stuffing: High-volume attacks conducted with automation tools

2. Healthcare Sector: Critical Data at Risk

The healthcare sector ranks second, exposed to 23% of cyber attacks. The acceleration of the post-pandemic digitalization process has expanded the target area for hospitals and healthcare institutions. According to SOME data, a 58% increase in ransomware attacks is observed in the healthcare sector.

The sensitivity and vital importance of healthcare data make this sector extremely attractive to attackers. The black market value of a patient record is 10-50 times higher than credit card information.

3. Energy and Critical Infrastructure: Strategic Targets

The energy sector and critical infrastructure facilities constitute 17% of total attacks. This sector is among the primary targets of state-sponsored APT groups. Attacks on SCADA systems, security vulnerabilities in industrial control systems, and supply chain attacks are prominent threats in this area.

4. Public Institutions and Local Governments

The public sector is exposed to 14% of cyber attacks. The widespread adoption of e-government applications, digitalization of municipal services, and electronic storage of citizen data have made this sector a significant target. DDoS attacks, data breaches, and website defacement attacks are the most common threats.

5. E-Commerce and Retail Sector

The rapidly growing e-commerce sector is targeted by 12% of cyber attacks. Payment card information theft, fake account creation, return fraud, and DDoS attacks are frequently seen threats in this sector.

6. Other Sectors

Education (8%), telecommunications (7%), manufacturing (5%), and other sectors (4%) constitute the remaining portion of cyber attacks.

APT Groups Targeting Turkey

Threat intelligence analyses conducted by USOM and SOME reveal the presence of many APT groups actively targeting Turkey. Among these groups are:

• APT28 (Fancy Bear): Attacks targeting public institutions and defense industry
• MuddyWater: Campaigns targeting public sector and critical infrastructure
• Sea Turtle: Telecommunications and DNS hijacking attacks
• Lazarus Group: Targeted attacks on the financial sector
• StrongPity: Espionage campaigns specifically focused on Turkey

These groups aim to establish long-term access, steal sensitive data, and gather strategic intelligence using advanced persistent threat techniques.

Most Common Attack Vectors

According to BTK and USOM statistics, the most frequently used attack vectors in Turkey are:

• Phishing - 38%: Social engineering attacks conducted via email, SMS, and social media
• Malware distribution - 24%: Trojans, ransomware, and spyware
• Vulnerability exploitation - 19%: Exploiting vulnerabilities in outdated systems