Foreign Company Victim of Ransomware in Turkey: Criminal Complaint, Evidence and Data Preservation (2026 Updated Guide)

A foreign company suffers a ransomware attack in Turkey. Learn how to preserve digital evidence, file a criminal complaint, protect logs and servers, document cryptocurrency demands and manage the investigation.

A ransomware attack against a foreign-owned company operating in Turkey can stop production, encrypt servers, disable accounting systems, expose customer information and create substantial financial losses within hours. The first reaction is often purely technical: isolate affected systems, restore backups and restart operations. However, ransomware is also potentially a criminal investigation, digital-evidence and corporate-risk matter. Actions taken during the first hours can determine whether the attacker can later be identified and whether critical evidence remains usable.

A foreign company should therefore coordinate cybersecurity containment with legal evidence preservation. Systems should not be unnecessarily wiped or reformatted before relevant forensic evidence is secured, ransom communications should be preserved, cryptocurrency-payment instructions should be recorded and a structured chronology of the incident should be created.

What Should a Foreign Company Do Immediately After Discovering Ransomware?

The company should activate its incident-response procedure and isolate compromised systems where technically appropriate. At the same time, it should preserve evidence concerning how the attack occurred and what the attacker did.

The objective is to contain the incident without unnecessarily destroying evidence.

Do Not Immediately Format Every Infected Computer

Rapid restoration may be commercially necessary, but indiscriminately wiping affected systems can destroy logs, malware artifacts, access records and other forensic evidence.

Before rebuilding critical devices, determine whether forensic imaging or another preservation method is appropriate.

Preserve the Ransom Note

Keep the original ransom message and record where it appeared.

Preserve screenshots and available metadata as well as any files containing payment instructions, deadlines, threats or contact information.

Preserve Emails From the Attackers

If attackers communicate by email, preserve the messages in their original electronic form where possible rather than relying only on screenshots.

Technical information contained in email records may become relevant to forensic analysis.

Preserve Cryptocurrency Wallet Addresses

Ransomware groups frequently demand payment through cryptocurrency.

Record every wallet address, amount demanded, cryptocurrency type, transaction instruction and communication concerning payment.

Preserve Chat Communications

If negotiations take place through a website, messaging platform or attacker-controlled portal, preserve the complete conversation.

Screenshots can help, but technical exports or other original records may provide stronger evidence where available.

Create an Incident Timeline

Record when suspicious activity was first detected, when systems became inaccessible, when the ransom note appeared, which systems were affected, what containment actions were taken and when management became aware of the incident.

Update the timeline as new facts emerge.

Preserve System Logs

Potentially relevant records can include authentication logs, firewall logs, VPN records, endpoint security alerts, server logs, cloud-access records and other security information.

Retention periods should be checked immediately because some systems automatically overwrite older records.

Preserve User Login Information

Determine which user accounts were accessed before and during the attack.

Suspicious login locations, times, devices and authentication events may help reconstruct the intrusion.

Preserve VPN Records

If remote access may have been used, VPN records can be particularly important.

The company should identify successful and failed connections, source addresses and the accounts involved.

Preserve Firewall and Network Records

Network logs may help identify communication between compromised systems and external infrastructure.

The company’s cybersecurity team should preserve relevant records before routine retention systems delete them.

Cloud Evidence Should Not Be Forgotten

If the business uses cloud infrastructure, preserve relevant audit and authentication records promptly.

Ransomware investigations should not focus solely on physical computers located in the Turkish office.

Determine the Initial Entry Point

Possible attack vectors include compromised credentials, phishing, vulnerable remote-access services, exposed servers, compromised suppliers or exploitation of software vulnerabilities.

The company should avoid publicly attributing the attack until the technical evidence is sufficiently developed.

Was Data Only Encrypted or Also Stolen?

Modern ransomware incidents may involve both encryption and data exfiltration.

Investigate whether attackers copied customer information, employee records, commercial secrets, contracts, financial data or other sensitive information before encryption.

Preserve Evidence of Data Exfiltration

If information may have left the network, preserve traffic records, security alerts and forensic findings supporting the conclusion.

Avoid assuming that a ransom message claiming “we stole all your data” is automatically accurate.

Take Forensic Images Where Appropriate

For important servers or endpoints, forensic preservation may be useful before remediation.

The process should be properly documented so that investigators can later understand how the evidence was obtained and preserved.

Maintain Chain of Custody

Record who collected each device or digital record, when it was collected, where it was stored and who subsequently accessed it.

This becomes particularly important if digital evidence is later submitted in criminal proceedings.

Avoid Unnecessary Changes to Original Evidence

Work from forensic copies where technically appropriate rather than repeatedly examining the original evidence.

Any unavoidable changes should be documented.

Can a Foreign Company File a Criminal Complaint in Turkey?

Potentially, yes. Where conduct affecting the company falls within Turkish criminal jurisdiction, the company may report the incident to the competent Turkish authorities and provide the available evidence.

The appropriate procedural strategy depends on the facts of the attack and the company’s connection with Turkey.

What Should the Criminal Complaint Contain?

The complaint should provide a clear factual chronology rather than simply state that “the company was hacked.”

It should identify the affected company and systems, date and time of discovery, nature of the unauthorized access, encryption, ransom demand, suspected data theft, known financial losses and evidence already preserved.

Technical Evidence Should Be Organized

Large quantities of raw logs should be accompanied by an explanation of what they show.

A structured evidence index can identify each server, device, log source, communication and forensic report.

Do Not Alter Evidence to Make It Easier to Read

Original records should be preserved separately. Investigative summaries or converted files can be prepared, but the underlying original data should remain available.

Can Turkish Authorities Seize Company Servers?

Depending on the investigation and applicable criminal-procedure requirements, digital systems or copies of data may become relevant to investigative measures.

Companies should coordinate with counsel and technical personnel so that legitimate investigative needs can be addressed while unnecessary business disruption is minimized where legally possible.

Business Continuity Should Be Planned Alongside Evidence Preservation

A company does not have to ignore operational recovery simply because an investigation may follow.

The goal is to preserve legally and technically significant evidence before systems are rebuilt or restored.

Document the Recovery Process

Record which backups were used, which systems were restored, which devices were replaced and what remediation measures were implemented.

This helps distinguish post-attack changes from the condition of the network at the time of the incident.

Preserve Backup Evidence

Backups can show the historical state of files and systems.

Do not automatically overwrite all previous backups during recovery.

Investigate Whether Backups Were Compromised

Attackers may attempt to delete or encrypt backup systems before launching ransomware.

Preserve evidence showing whether backup infrastructure was accessed.

Should the Company Pay the Ransom?

This decision creates significant legal, sanctions, financial, operational and cybersecurity risks. Payment does not guarantee restoration or deletion of stolen information.

Before any payment, the company should evaluate the recipient, applicable sanctions risks, insurance position, payment mechanics and law-enforcement implications.

Sanctions Screening Can Be Critical

A ransomware payment can create additional legal concerns where the recipient or associated infrastructure is connected with a sanctioned person or organization.

The company should therefore avoid treating payment as a purely technical decision.

Preserve All Payment Discussions

If management considers payment, preserve communications with negotiators, insurers, cybersecurity advisers and other relevant participants.

If a payment is ultimately made, retain complete transaction records.

Cryptocurrency Transactions Should Be Documented

Keep wallet addresses, transaction identifiers, timestamps, amounts and exchange-related records.

These may later assist financial tracing.

Cyber Insurance Should Be Notified Promptly

If the company has cyber insurance, review notification requirements immediately.

Policies may contain requirements concerning forensic vendors, legal advisers, ransomware negotiations and consent before incurring certain expenses.

Preserve Evidence of Financial Loss

Keep records of production shutdown, lost sales, emergency IT expenses, forensic fees, recovery costs and other direct financial consequences.

Do not wait until months later to reconstruct the financial impact.

Employee Evidence May Be Important

Identify employees who first noticed suspicious activity, received phishing messages or interacted with compromised accounts.

Their recollections should be documented while events remain fresh.

Preserve Suspicious Emails

If phishing is suspected, preserve the original email and available technical information.

Do not merely forward the message repeatedly, as this may make later technical analysis more difficult.

Third-Party Service Providers Should Be Contacted

Cloud providers, hosting companies, managed service providers and other technology vendors may hold logs that the company itself does not possess.

Request preservation promptly where appropriate.

Supply-Chain Attacks Require Wider Investigation

If the ransomware entered through a vendor or shared software platform, preserve contracts, security correspondence and technical records concerning the third party.

Potential contractual responsibility may need separate analysis.

Foreign Headquarters Should Coordinate With the Turkish Entity

For multinational groups, the Turkish company and foreign headquarters should establish a unified incident-response structure.

Evidence may exist across several jurisdictions and corporate entities.

Avoid Contradictory Internal Reports

Cybersecurity, legal, management and public-relations teams should work from a verified factual chronology.

Unconfirmed technical assumptions should not be presented internally or externally as established facts.

Internal Investigation Documents Need Careful Management

Companies should distinguish operational incident reports, forensic findings, legal assessments and communications prepared for different purposes.

Sensitive material should be handled through an appropriate legal structure.

Personal Data Issues May Arise

If the attackers accessed information relating to identifiable individuals, the company should separately evaluate its obligations under the applicable Turkish personal-data framework.

The criminal complaint and data-protection response are related but distinct workstreams.

Trade Secrets May Also Be Stolen

Ransomware attackers may obtain source code, pricing information, technical designs, customer lists or strategic documents.

Identify sensitive commercial information that may have been exfiltrated and preserve evidence of its confidentiality and economic importance.

Monitor for Publication of Stolen Data

Some attackers threaten to publish information if payment is refused.

Any monitoring should be performed safely and lawfully. Preserve evidence if company data later appears online.

Do Not Contact Suspected Attackers Informally

Employees should not independently communicate with attackers from personal accounts or devices.

Communications should be centrally controlled and documented.

Do Not Publicly Accuse a Specific Person Without Evidence

IP addresses, usernames or cryptocurrency wallets do not necessarily establish the identity of an individual attacker.

Attribution should be based on sufficient technical and investigative evidence.

Can Evidence From Foreign Cybersecurity Firms Be Used?

Foreign forensic reports can potentially provide valuable evidence. The company should preserve the underlying methodology, source data and records demonstrating how the conclusions were reached.

Cross-Border Evidence May Be Necessary

Attack infrastructure, hosting providers, cryptocurrency exchanges and suspects may be located outside Turkey.

The investigation may therefore require international evidence-gathering mechanisms depending on the circumstances.

What If the Attacker Cannot Be Identified?

A criminal complaint may still be important even where the perpetrator is initially unknown.

Preserved technical evidence may later connect the attack with other investigations or identified infrastructure.

Do Not Delay the Complaint While Searching for the Attacker

The company does not need to complete its own attribution investigation before approaching the authorities.

Known facts can be presented while additional evidence is preserved and developed.

Can Company Executives Be Questioned?

Investigators may seek statements from managers, IT employees or other personnel who can explain the incident.

Relevant witnesses should review the factual chronology and distinguish personal knowledge from information learned from others.

Foreign Managers May Need Interpretation

A foreign company representative who does not sufficiently understand Turkish should ensure that they understand the procedural documents and statements attributed to them. Interpretation issues should be addressed before signing records.

Review Documents Before Signing

Company representatives should read investigative records carefully and ensure that technical descriptions and factual statements accurately reflect what they said.

Errors should be raised before signature where possible.

Preserve Evidence Even After Systems Are Restored

Operational recovery does not end the legal process.

Maintain a secure evidence archive containing forensic images, logs, communications, reports, screenshots, ransom notes, wallet information and investigation correspondence.

Build a Ransomware Evidence File

A well-organized file should include the incident chronology, affected-system inventory, forensic preservation records, ransom communications, cryptocurrency information, security logs, backup records, employee statements, financial-loss evidence and correspondence with relevant third parties.

Frequently Asked Questions

Can a foreign-owned company report ransomware to Turkish authorities?

Potentially, yes. Where the conduct falls within Turkish criminal jurisdiction, the company can evaluate filing a criminal complaint and submitting preserved digital evidence.

Should infected computers be formatted immediately?

Not before considering whether relevant forensic evidence should first be preserved. Operational recovery and evidence preservation should be coordinated.

Are screenshots of the ransom note enough?

Screenshots are useful, but original electronic files, communications, metadata and associated technical evidence should also be preserved where available.

Should cryptocurrency wallet addresses be saved?

Yes. Wallet addresses, transaction instructions and related communications can become important investigative evidence.

Can the company restore its systems before filing a complaint?

Yes, but critical evidence should be preserved before restoration destroys or changes it.

Should the ransom be paid?

Payment requires careful assessment of legal, sanctions, insurance, cybersecurity and commercial risks. It does not guarantee successful recovery or deletion of stolen data.

Can foreign forensic reports be submitted?

Potentially. Their evidentiary value will be stronger where methodology and underlying technical records are properly preserved.

What if customer or employee information was stolen?

The company should separately evaluate applicable personal-data obligations in addition to the criminal investigation.

What if the attackers are located outside Turkey?

Cross-border investigative and evidence-gathering mechanisms may become necessary.

What is the most important first step?

Contain the attack without destroying the evidence. Preserve logs, compromised-system evidence, ransom communications, cryptocurrency information and the incident chronology before routine restoration or deletion makes reconstruction of the attack substantially more difficult.

Client-Focused Legal Support for Ransomware and Cybercrime Cases in Turkey

Ransomware incidents involving foreign companies can require simultaneous management of criminal complaints, digital evidence preservation, forensic investigations, cryptocurrency tracing, business interruption, cyber insurance, personal-data exposure and cross-border evidence.

Fırat Fesih Kaya Law Office assists foreign companies and international investors affected by cybercrime and ransomware incidents in Turkey. Lawyer Fırat Fesih Kaya provides legal assistance in preparing criminal complaints, organizing digital evidence, coordinating forensic documentation, protecting company representatives during criminal proceedings and evaluating related financial and contractual claims.

Phone: +90 312 434 22 22

Mobile: +90 532 769 22 22

Email: info@firatfesihkaya.av.tr

Address: Mevlana Boulevard No:221, Yıldırım Tower, Office No:148, 06520 Balgat, Çankaya, Ankara, Turkey