Ukraine's largest grocery chain confirms cyberattack as hackers threaten to leak customer data

TLDR

• ATB, Ukraine's largest grocery store chain with more than 1,300 stores, confirmed a cyberattack after hackers posted a ransom demand on its website.
• The hacker group DataSuckers claims to have stolen data on 7.9 million customers and demanded $400,000, with a countdown timer briefly displayed on ATB's site.
• ATB denies any customer data was compromised, saying the affected systems do not store personal data and the attack was contained to "technical maintenance."
• DataSuckers has since published data samples and employee/supplier record counts on Telegram and says it will sell, rather than leak, the full database if unpaid.

The hacker group DataSuckers claimed responsibility for the attack and demanded $400,000, threatening to publish data it said it had stolen from millions of ATB customers.¹ A countdown timer for the ransom demand appeared on the retailer's website before being removed, and the site was unavailable at the time of reporting.¹ ATB denied that customer data had been compromised, saying it temporarily took some online services offline for what it described as technical maintenance: "The temporary message displayed on the website did not affect the security of your data," the company said. "The website remains fully under ATB's control, and all information is securely protected."¹

In response, DataSuckers published samples of the allegedly stolen data on its Telegram channel and said it would not leak the full database but would instead sell it "for a substantial amount."¹ The group claims to have obtained data on 7.9 million customers, including names, phone numbers, email and physical addresses and password hashes, as well as passport information for more than 127,000 employees and tax and contact details for more than 50,000 suppliers.² ATB spokesperson Serhii Demchenko told RBC-Ukraine: "Indeed, hackers are attacking the company's resources. No personal data has been compromised because we do not store it on these resources. The attack poses no danger."² The authenticity and scale of the alleged breach could not be independently verified.¹

ATB operates more than 1,300 stores and employs more than 60,000 people, and has already suffered extensive damage from Russia's war in Ukraine, including destroyed stores and damaged warehouses.¹ DataSuckers describes itself as financially motivated rather than politically aligned and has recently claimed attacks on Russian firms, including fast-food chain Dodo Pizza and tour operator Tez Tour, publishing detailed accounts of its intrusions on Telegram and inviting victims, journalists and law enforcement to contact it directly.¹

Why it matters: a financially motivated group that usually targets Russian businesses turning its attention to Ukraine's largest grocery chain, paired with a flat denial from the victim and no independent verification of the stolen data, leaves open whether this is a real breach of millions of records or an extortion bluff built on a smaller intrusion.