Acikogretim, a Turkish education forum at acikogretim.gen.tr, appears in the leaksear.ch index with 213,158 account records tied to a breach date of November 1, 2019 (leaksear.ch metadata). The indexed fields include usernames, email addresses, password hashes, salts, and IP addresses (leaksear.ch metadata).
What happened
Public context for acikogretim.gen.tr is limited. An August 21, 2019 Wayback Machine capture shows the site as Açıköğretim Forumları, with registration, forum, blog, course-notes, and exam-related sections visible (web.archive.org).
HackNotice published a public notice on January 19, 2026 titled Acikogretim | acikogretim.gen.tr | 2019-11 | 213.19K Users and said its monitoring picked up the report from public data streams (hacknotice.com). The leaksear.ch index lists October 26, 2026 as the date the dataset was indexed (leaksear.ch metadata).
HackNotice's public notice does not identify an attacker, ransomware group, exploit path, or operator confirmation (hacknotice.com). On the available facts, this should be treated as an exposed forum account dataset rather than a fully attributed intrusion.
What data was exposed
The leaksear.ch index for Acikogretim contains email, username, IP address, hashedPassword, and salt as searchable fields (leaksear.ch metadata). The records also include raw IP address and raw password hash fields as non-searchable record context (leaksear.ch metadata).
The indexed data does not list plaintext passwords as an exposed field (leaksear.ch metadata). The presence of password hashes and salts still matters because hashes can become useful to attackers if they are cracked or matched to reused credentials.
Why this matters
Email addresses and usernames from a forum about open education give phishers believable lures tied to study accounts, exam discussions, or password-reset messages, especially when paired with IP address context from the same records (leaksear.ch metadata). The archived site context shows the forum centered on open-education topics and exam-related discussions (web.archive.org).
Password hashes and salts create password-cracking and credential-reuse risk if users reused the same or similar password elsewhere, and the FTC advises changing breached passwords and any reused or similar passwords on other services (consumer.ftc.gov). If any hashes are cracked, credential stuffing becomes a risk because OWASP describes credential stuffing as testing breached username and password pairs against other sites (community.owasp.org).
Readers who used acikogretim.gen.tr should check whether their email, username, IP address, hashed password, or salt is present so they can rotate reused passwords and respond to targeted phishing (leaksear.ch metadata).
Check your exposure
Request access to check this leak source, or sign in if you already have an account. You can search it by email, hashed password, ip address, salt, and username.