ATB, Ukraine's largest grocery chain, has confirmed a cyberattack after hackers placed an extortion message on its website and a group calling itself DataSuckers demanded $400,000, The Record reported Monday. The attackers claim to hold personal data on 7.9 million customers, while ATB says its customers' information remains protected.

What Happened

The ransom message appeared on ATB's website alongside a countdown timer, which was later taken down. The company temporarily took some of its online services offline, describing the outage as technical maintenance.

DataSuckers claimed responsibility and listed what it says it took: customer names, phone numbers, email and home addresses and password hashes, along with passport data belonging to employees and more than 11 million order records. The group posted samples on its Telegram channel to back up the claims. It said it does not plan to leak the full database publicly and would instead sell it for what it called a substantial sum.

RelatedIsraeli Ad Firm Turned Targeted Ads Into Zero-Click Spyware Delivery, Researchers Say

In a statement on Facebook, ATB said the temporary message on its website had not affected the security of customers' data. The company said the site remains fully under its control and that all information is securely protected. Neither the hackers' claims nor ATB's assurances have been independently verified, and The Record did not report details of any forensic investigation or involvement by Ukrainian authorities.

Why It Matters

ATB operates more than 1,300 stores and employed more than 60,000 people as of early 2026, so a breach of its customer systems could reach a large share of Ukrainian shoppers. If the claimed records are genuine, the combination of contact details and password hashes could be used for phishing and for credential-stuffing attempts against other services where customers reused passwords. Employee passport data carries a separate risk of identity fraud.

The threat to sell rather than leak the data also changes the calculus for customers. A public leak is visible and can be checked, while a private sale leaves people unable to know who holds their information or how it might be used.

Who Is DataSuckers

The group describes itself as financially motivated rather than politically driven and communicates mainly in Russian. Its location is unclear, and it openly invites victims and journalists to contact it.

DataSuckers has also claimed attacks on Russian businesses. Pizza chain Dodo Pizza confirmed a breach of customer details after the group's claim, while travel operator Tez Tour had its website disrupted, though data theft there was not confirmed. Targeting companies on both sides of the war fits the group's portrayal of itself as purely profit-driven.

Context

ATB has been badly hit by Russia's full-scale invasion, losing hundreds of stores and warehouses to the fighting. Ukrainian businesses and public services have faced a steady stream of cyberattacks throughout the war, ranging from operations attributed to Russian state hackers to criminal extortion schemes like this one.

What to Watch

The main questions are whether DataSuckers follows through on selling the database, whether further samples confirm or undercut its claims, and whether ATB's own review finds that customer records were taken. Customers of the chain may want to watch for phishing messages that use their order history and to change any reused passwords as a precaution.