Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
Ransomware victim Other

merkezilac_archives

Listed by Hyflock on · organisation based in Turkey

merkezilac.com

Disclosed
Oct 13, 2026
Leak-site listing date
Threat group
Hyflock
8 victims listed
Country
Turkey
#18 most targeted
Sector
Other

ThreatAI analysis

Compiled from this incident record and the threat intelligence profile for Hyflock. Figures and technique mappings are quoted from the source data, not inferred.

About merkezilac_archives

It is not a retail pharmacy, but a well-known large-scale comprehensive pharmaceutical and hygiene/disinfection product manufacturer with nearly a century of history. Here’s a detailed introduction about the company: 🏢 Company Background and Scale • Founded: Established in 1934, it is one of the oldest local pharmaceutical factories in modern Turkey, with 100% Turkish capital. • Production Base: Its modern central laboratory and factory are located in Çekmeköy, Istanbul, Turkey, with high-standard closed production workshops covering an area of 7,000 square meters. • Certification Standards: Production is fully supervised by the Turkish Ministry of Health (T.C. Sağlık Bakanlığı) and has passed a series of international certifications including cGMP (current Good Manufacturing Practice), cGLP (Good Laboratory Practice), ISO 9001, and ISO 13485 (Medical Device Quality Management System). 🧪 Core Products and Business Merkez İlaç follows its iconic slogan “#sağlıkiçinhijyenşart” (Hygiene is a prerequisite for health) and is the leader in Turkey for first aid, skin care, and disinfection products, with the most complete product categories and extremely high market share: 1. Disinfection and Anti-infection Series (core products): • Produces various professional and consumer skin disinfectants, hand sanitizers, anti-infection foams, surgical wipes, and wound cleansers (common brands include Opakjel and İsosol series). 2. Over-the-Counter (OTC) Medicines and Ointments: • Produces skin ointments and creams, such as İhtamol ointment, Starbaz cream, İsosol ointment, Vitamin E, and baby diaper rash cream (Pişik Kremi) for skin care, burns, and eczema. 3. First Aid and Medical Consumables: • It is the first and only company in the Turkish pharmaceutical industry to legally produce standardized first aid kits (Hızır medical kits, covering earthquakes, home, car, and industrial scenarios) and household/commercial medicine boxes. 4. Contract Manufacturing (CMO): • In addition to its own brand, it also manufactures tablets, capsules, sprays, drops, liquids, and semi-solid ointments for over 50 global and local pharmaceutical companies. 🌍 Industry Influence The company’s service network is extremely extensive, directly supplying products to over 3,000 local pharmacists and more than 9,500 hospitals and clinics in Turkey, and exporting to multiple overseas countries. In international humanitarian aid (such as Red Crescent supplies and earthquake donations), it is also a major provider of medical supplies and surgical/first aid consumables in Turkey.

Source record: ransomware.live

About the Hyflock group

Hyflock has listed 8 victims since September 2026.

Incident analysis

merkezilac_archives was listed by Hyflock ransomware, a group with 8 victims recorded in this database. The listing appeared on the group's leak site on October 13, 2026.

merkezilac_archives is based in Turkey and operates in the Other sector. Turkey ranks #18 worldwide for ransomware disclosures, with 172 victims in this database.

Sector context. Organisations in this sector hold valuable data and operational systems that ransomware groups seek to exploit for financial gain through encryption and data exfiltration.

Hyflock typically follows a double extortion model: data is exfiltrated from the victim's systems before files are encrypted, so the victim faces two demands at once — pay to restore access, and pay to keep stolen data unpublished. The leak site, where this listing appeared, is the lever for the second demand.

Source. Public leak-site disclosures aggregated via the ransomware.live API. The disclosure date is when the listing was published, which can differ from the date of compromise. This site does not publish or link to stolen data. Last updated .

Frequently asked questions

Was merkezilac_archives attacked by ransomware?

Yes. merkezilac_archives was listed as a victim of the Hyflock ransomware group on October 13, 2026. The organisation is based in Turkey and operates in the Other sector. The disclosure appeared on the group's dark web leak site.

Which ransomware group attacked merkezilac_archives?

merkezilac_archives was attacked by Hyflock ransomware. Hyflock is one of the most active ransomware groups, having claimed 8 victims globally. The group typically employs a double-extortion model: encrypting the victim's files and threatening to publish stolen data.

When did the merkezilac_archives ransomware attack occur?

The ransomware attack on merkezilac_archives was disclosed on October 13, 2026. This date reflects when the victim was published on the threat group's leak site, which may differ from the actual date of initial compromise.

What data was stolen in the merkezilac_archives ransomware attack?

The specific data stolen from merkezilac_archives has not been independently verified by this platform. Ransomware groups typically exfiltrate data before encrypting systems and use the threat of publication to pressure victims. As a Other organisation, merkezilac_archives likely held sensitive business data, client information, and operational records.

How can organisations protect against Hyflock attacks?

To defend against Hyflock and similar threat actors, organisations should: maintain regular offline backups tested for restoration; implement network segmentation to limit lateral movement; deploy multi-factor authentication on all remote access; use endpoint detection and response (EDR) tools; conduct regular phishing and security awareness training; and monitor threat intelligence feeds for indicators of compromise (IOCs) associated with active groups.