2026 ATB Ukraine — website hijack / DataSuckers $400k extortion; company denies customer-data theft
Data compromised
Actor (DataSuckers) claims ~7.9M customers — names, phones, emails, physical addresses, password hashes; employee passport data; records of >11M orders. ATB states temporary website message did not affect data security and denies customer-data compromise. Actor census unverified.
Technical writeup
Verified cyberattack (company confirmed) — Ukraine’s ATB grocery chain acknowledged a cyberattack on Oct 6, 2026 after its website displayed a DataSuckers extortion message demanding $400,000 with a two-hour countdown (later removed). ATB said the temporary website message did not affect customer data security, that the site remained under ATB control, and denied customer-data compromise; some online services were taken offline for maintenance. In response, DataSuckers published purported samples on Telegram and claimed ~7.9 million customer records plus employee passport information and >11 million order records, saying it would sell rather than fully leak the database. Authenticity and scale of the alleged data theft could not be independently verified at indexing. recordsAffected 7900000 reflects the actor claim and is labeled unverified for data theft; companyConfirmed true for the website/cyberattack acknowledgment.
Root cause
Confirmed cyberattack: public website replaced with DataSuckers extortion page ($400k + countdown). Company denies customer-data compromise; actor claims ~7.9M records (unverified).