Ukraine’s largest grocery retailer confirmed on October 5, 2026, that it had been hit by a cyberattack, after an extortion group calling itself DataSuckers posted a ransom note directly on the company’s website. The chain, ATB-Market, operates more than 1,300 stores and employs over 60,000 people, according to The Record. ATB temporarily took its website and app offline as it responded to the incident, BBC News Ukraine reported. The attackers claim to hold records on 7.9 million customers and more than 11 million orders, and they want $400,000 to keep the data offline.
ATB disputes the scale of the claim. The company says customer data was not compromised and has stated that no personal data was stored on the specific resources affected by the intrusion, even as DataSuckers published sample files on its Telegram channel to back up the allegation, per Ukrainska Pravda. That gap between what a retailer says and what an extortion group claims has become a recurring feature of 2026’s breach cycle, and it’s worth examining closely because the numbers on both sides carry real weight for shoppers, suppliers, and the broader food-retail sector.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What ATB Confirmed, and What DataSuckers Claims
The attack surfaced publicly when a ransom note appeared on ATB’s own website, complete with a 2-hour countdown clock ticking down toward the threatened leak, according to Ukrainska Pravda (reporting on October 6, 2026 added that the timer initially showed an incorrect time and that the note asked for payment in Bitcoin or USDT), a tactic extortion crews increasingly favor because it forces disclosure on their timeline rather than the victim’s. ATB confirmed it had suffered a cyberattack but pushed back on the idea that customer records had actually left its systems intact. DataSuckers, in turn, said it had spent time inside ATB’s infrastructure before going public, and it posted screenshots it described as proof of the intrusion.
The disagreement isn’t unusual. Companies have strong incentive to minimize a breach before forensics are complete, while extortion groups have equally strong incentive to inflate numbers to pressure a payout. What makes this case worth tracking is the sheer size of the claim: if even a fraction of the 7.9 million customer records are real, it would rank among the largest consumer-data exposures tied to a single retailer in Eastern Europe this year.
Who Is DataSuckers?
DataSuckers is a relatively new name in the ransomware and data-extortion space, and it describes itself as financially motivated rather than tied to any state or political cause. The group runs its operation almost entirely through a public Telegram channel, where it posts details of intrusions, invites journalists and victims to reach out directly, and releases sample data to pressure targets into paying.
ATB is not DataSuckers’ first high-profile claim. In September 2026, the group said it had broken into Dodo Pizza, a Russian-founded fast-food chain with roughly 1,500 restaurants across 28 countries, allegedly accessing customer names, addresses, emails, phone numbers, birth dates, and order histories. Dodo later confirmed attackers may have reached some of that information. DataSuckers also claimed responsibility for defacing the website of Tez Tour, a major Russian travel operator, saying it had sat inside the company’s network for roughly two weeks before extracting customer data.
Three claimed victims in two months, each a consumer-facing company with large transaction databases, suggests a group that has found a repeatable playbook: breach a company with millions of loyalty or order records, skip the encryption step entirely, and threaten publication instead.
The Numbers Behind the ATB Claim
DataSuckers’ public claims break down into three separate pools of data, each carrying its own risk profile. The group says it obtained records on 7.9 million customers, including names, phone numbers, email addresses, physical addresses, and password hashes. It separately claims access to 127,265 employee records containing identification details, and 50,300 supplier records with tax information and contact data. On top of the customer profiles, DataSuckers also claims more than 11 million individual order records, a figure that implies deeper access to transactional systems than a simple contact-list theft would require.
| Claimed Data Category | Alleged Volume | Data Types Involved |
|---|---|---|
| Customer records | 7.9 million | Names, phone numbers, emails, addresses, password hashes |
| Order records | 11+ million | Purchase and transaction history |
| Employee records | 127,265 | Identification details |
| Supplier records | 50,300 | Tax information, contact details |
| Ransom demand | $400,000 | Threatened publication if unpaid |
None of these figures have been independently verified by a third party at the time of writing. They come from DataSuckers’ own disclosure and the sample files it posted to Telegram, which is the same pattern seen in dozens of 2026 extortion cases where the attacker’s number becomes the headline long before forensic investigators confirm anything.
Why Password Hashes Change the Risk Calculus
A leaked name and phone number is annoying. A leaked password hash is a different category of problem, because it gives attackers a head start on cracking real credentials, especially for customers who reused the same password across multiple sites. If DataSuckers really holds hashes for 7.9 million ATB accounts, the practical risk isn’t limited to spam or phishing. It extends to account takeover on any other service where a customer reused that password, which is still common despite years of security guidance pushing against it.
The employee passport and identification data adds a second layer entirely. Identity documents are far harder to replace than a password, and they carry long-term value for identity fraud. A grocery chain with 60,000 employees sits on a large pool of exactly this kind of data, which is part of why retail and food-sector breaches have become so attractive to extortion groups over the past two years.
Grocery and Retail Chains Keep Landing on Leak Sites
ATB joins a growing list of food and retail companies hit in 2026 and late 2025. Ahold Delhaize, the parent of US chains including Hannaford and Stop & Shop, had information on more than 2.2 million people stolen in a cyberattack that also knocked out online delivery ordering. United Natural Foods, the primary distributor for Whole Foods, suffered an attack in June 2025 that disrupted supply chains at stores nationwide, and a separate food retail giant behind several US supermarket brands later confirmed data was stolen in a ransomware breach of its own. In the UK, Co-op’s 2025 breach caused empty shelves in some locations and was linked to the Scattered Spider group.
The pattern extends beyond groceries. UK fashion retailer Asos saw its shares drop 13% after a hack threat turned its own app into a de facto ransom note, a near-identical tactic to what DataSuckers used against ATB. Several of 2026’s most active ransomware and extortion crews, including Qilin, Play, Safepay, Akira, and Scattered Spider, have all turned attention toward food-sector targets, according to industry trackers. Retail and grocery operators tend to run on tight margins, carry large customer databases, and face intense pressure to stay online, which makes them more likely to pay or negotiate quickly compared with sectors that can tolerate longer downtime.
Comparing ATB to Other 2026 Retail and Food-Sector Breaches
Lined up against other recent incidents, the ATB claim sits near the top of the pack by alleged customer count, though well below some of the largest breaches logged this year across all sectors. The table below compares publicly reported figures for recent retail and food-sector incidents.
| Company | Sector / Region | Attacker | People Affected | Ransom / Demand |
|---|---|---|---|---|
| ATB-Market | Grocery, Ukraine | DataSuckers | 7.9 million (claimed) | $400,000 |
| Ahold Delhaize (Hannaford, Stop & Shop) | Grocery, US | Unattributed | 2.2 million | Not disclosed |
| Asos | Fashion retail, UK | Extortion threat | Undisclosed scope | Not disclosed |
| Dodo Pizza | Food service, multi-country | DataSuckers | Undisclosed | Not disclosed |
| Co-op UK | Grocery/retail, UK | Scattered Spider | Undisclosed | Not disclosed |
Industry-wide data backs up the sense that retail has become a soft target. Black Kite’s 2026 Wholesale & Retail Cyber Risk Report found that more than 70% of major retailers, nearly 60% of wholesalers, and 52% of the broader supply chain carry exposed credentials that attackers can find and exploit. Across the retail and wholesale sectors combined, Black Kite tracked 636 publicly disclosed ransomware victims attributed to known groups between late 2024 and late 2025, split roughly 400 wholesale and 236 retail.
The Extortion-Only Playbook
Notably, nothing in DataSuckers’ claims about ATB mentions encryption. That fits a broader shift this industry has tracked through 2026, in which attackers increasingly skip locking up files altogether and go straight to data theft plus a threat to publish. This approach is faster to execute, harder for defenders to detect through traditional ransomware monitoring, and doesn’t require the operational complexity of deploying and managing encryption malware across a target’s network.
Our earlier coverage found that ransomware-linked data theft has surged 275% year over year at schools and hospitals, two sectors that, like grocery retail, hold large stores of personal data and face strong pressure to keep services running. Group-IB’s broader 2026 ransomware analysis similarly found that attack volume is climbing even as the share of victims who actually pay has fallen to a 23% low, a sign that extortion crews are adjusting their economics by targeting more victims rather than extracting bigger individual payouts.
Is $400,000 a Rational Demand for a Company ATB’s Size?
Measured against the claimed 7.9 million customer records, $400,000, payable in Bitcoin or USDT according to Ukrainska Pravda, works out to roughly 5 cents per record, a figure well below what large-scale breaches with verified, high-value data (financial account numbers, health records, government IDs) have historically commanded. That low per-record price suggests DataSuckers is pricing the demand for a quick settlement rather than a protracted negotiation, betting that a company with 1,300 storefronts and a reputation to protect in a wartime economy will prefer to pay and move on rather than risk a drawn-out public dispute.
It’s also a modest number next to the economics of the ransomware industry more broadly. Our deep dive into the $20 billion ransomware economy found that smaller, faster-moving extortion operations increasingly favor volume over scale, running multiple simultaneous shakedowns rather than betting everything on one large payout. A $400,000 ask against a company with 60,000 employees and more than a thousand physical locations is a rounding error compared with the operational cost of a prolonged outage, which is exactly the calculation DataSuckers appears to be counting on.
ATB’s Denial and the Verification Problem
ATB’s public position, that customer data was not compromised because the affected resources were under its control and did not store the personal data in question, with the disruption described as technical maintenance, puts it in a familiar bind shared by nearly every company facing this kind of claim. Saying too little looks evasive. Saying too much before forensics are complete can create legal exposure if the real numbers later turn out worse. The company has said its services would be restored once technical work was completed, according to the outlet NV. DataSuckers responded to ATB’s denial by posting sample records to its Telegram channel, a tactic meant to force the company’s hand by putting proof, however partial, into public view.
This is where outside verification matters most, and where reporting from outlets tracking the story, including The Record and Ukrainska Pravda, has been careful to frame the 7.9 million figure as an attacker claim rather than a confirmed fact. Security researchers typically need direct access to leaked samples, hashing comparisons against known breach datasets, and time, none of which is available within the first 48 hours of a story like this one.
Historical Context: From Encryption Demands to Pure Data Leverage
Three years ago, a ransomware attack on a retailer this size would almost certainly have involved file encryption, a frozen point-of-sale system, and empty shelves within days, the kind of operational chaos that made headlines on its own. The shift toward data-only extortion, visible in cases from Co-op’s 2025 disruption to the DataSuckers pattern now playing out at ATB, reflects attackers realizing that stolen data alone, especially data tied to a brand’s reputation with millions of regular shoppers, can apply nearly as much pressure as a shutdown, without the forensic footprint of deploying encryption malware across a corporate network.
That shift also makes these attacks harder to catch early. A ransomware encryption event triggers immediate, visible system failures. A quiet data exfiltration can run for days or weeks, exactly as DataSuckers claims happened at Tez Tour, before the victim even knows an intrusion occurred.
What Regulators and Industry Watchers Will Be Looking For
If any portion of the claimed customer data is confirmed as genuine, Ukrainian data protection authorities would be expected to require formal notification to affected individuals, mirroring steps taken in comparable breaches across the EU and UK in 2025 and 2026. Suppliers whose tax records are allegedly included face their own notification and liability questions, since tax data tied to business identities carries different regulatory weight than consumer contact information.
The broader context matters too. Global data breach tracking shows that more than 471 million people had data exposed in breaches during the first half of 2026 alone, meaning ATB’s claimed 7.9 million customers, even if fully confirmed, would represent a small slice of a much larger global problem that regulators are still struggling to keep pace with.
What Retailers Can Do Differently
Retail and food-sector IT teams facing similar exposure have a fairly consistent list of gaps to close: rotating and hashing credentials properly, segmenting point-of-sale and loyalty databases away from general corporate networks, and limiting how much supplier and employee identification data lives in systems reachable from customer-facing infrastructure. Our step-by-step breakdown of how to protect against ransomware covers the baseline controls that would have blunted several elements of the DataSuckers playbook, from credential hygiene to network segmentation between customer and backend systems.
Predictions: Where the ATB Story Goes Next
Based on how comparable 2026 extortion cases have played out, a few outcomes look likely in the coming weeks:
- ATB will face mounting pressure to commission an independent forensic review, given the gap between its denial and DataSuckers’ published samples.
- DataSuckers will likely release additional sample data on Telegram if the $400,000 demand goes unpaid past its stated deadline, following the same escalation pattern it used against Tez Tour.
- Do not assume another named DataSuckers victim will follow. Russian authorities reportedly detained three suspected members and a Moscow court placed one under house arrest on October 14, 2026, and the group reportedly said it would continue operating with reduced public activity, so its future activity remains unconfirmed.
- Other grocery and food-retail chains, particularly in Eastern Europe, will likely see heightened scrutiny of their own credential exposure following this incident.
- Regardless of whether the 7.9 million figure holds up, expect Ukrainian and EU data-protection bodies to request information from ATB given the scale of the claim alone.
Frequently Asked Questions
What is the ATB cyberattack?
ATB, Ukraine’s largest grocery chain, confirmed on October 5, 2026, that it suffered a cyberattack after an extortion group called DataSuckers posted a ransom note on its website, demanding $400,000 and claiming to hold data on 7.9 million customers.
Who is DataSuckers?
DataSuckers is a financially motivated extortion group that operates primarily through a public Telegram channel. It has also claimed attacks on Dodo Pizza and Tez Tour in the weeks before the ATB incident.
Has ATB confirmed that customer data was stolen?
No. ATB has denied that customer data was compromised, even though DataSuckers published sample files it says prove the intrusion. The claimed 7.9 million customer records have not been independently verified.
What kind of data did DataSuckers claim to steal?
The group claims to hold customer names, phone numbers, emails, addresses, and password hashes for 7.9 million people, plus more than 11 million order records, 127,265 employee identification records, and 50,300 supplier tax and contact records.
How does the ATB breach compare to other 2026 retail breaches?
By claimed customer count, ATB’s alleged 7.9 million figure is larger than the 2.2 million affected by the Ahold Delhaize breach that hit US chains Hannaford and Stop & Shop, though it remains unverified, unlike several other 2026 retail incidents with confirmed totals.
Why are grocery and retail chains being targeted so often?
Retailers hold large customer and transaction databases, operate on thin margins that make downtime costly, and, according to Black Kite’s 2026 research, carry widespread exposed credentials across the sector, making them attractive and relatively easy targets.
Did DataSuckers encrypt ATB’s systems?
Public reporting on the claim does not mention file encryption. The attack follows the increasingly common pattern of pure data theft paired with a publication threat, rather than a traditional ransomware lockout.
What should ATB customers do now?
Until the breach is independently confirmed, affected customers should still change reused passwords tied to their ATB account, watch for phishing attempts referencing their order history, and monitor for unusual account activity on other services where they may have reused the same password.
