SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
DataSuckers answers ATB's breach denial with samples of allegedly stolen data
DataSuckers demanded $400,000 from ATB, Ukraine's largest grocer, claiming records on 7.9 million customers that the company denies were compromised. The samples it posted on Telegram are the only public evidence against ATB's statement that its data is protected.
The Watch · Security desk
What happened
- ATB confirmed the cyberattack on Monday, after the extortion demand and a countdown timer appeared on its own website; the timer was later removed.
- The group said it would not leak the full database and would instead sell it "for a substantial amount."
- The claimed haul lists customer names, phone numbers, email and physical addresses and password hashes, plus employee passport details and more than 11 million order records.
- The Record could not independently verify the published screenshots, the authenticity of the data or the scale of the alleged breach.
Why it matters
- exposure If the samples prove genuine, ATB customers are open to phishing that cites their real addresses and orders, and staff whose passport details were taken face a risk of identity fraud.
- constraint With the database offered for sale instead of dumped, ATB customers get no public file to check themselves against, and buyers can hold the data while its authenticity is still disputed.
- precedent One of the two earlier victims The Record names later conceded possible data access, so the ATB claim comes from a group whose past claims have held up at least once.
ATB's assurance, as The Record reported it, came in two sentences. "The temporary message displayed on the website did not affect the security of your data," ATB said. "The website remains fully under ATB's control, and all information is securely protected." [5][6] The first sentence ties the assurance to the defacement. The second extends it to all information. That covers the customer, staff and order records the group says it holds [17].
ATB runs more than 1,300 stores and employs more than 60,000 people [9]. Against the claimed 7.9 million customers, the $400,000 demand works out to about five cents a record [15]. Of the claimed fields, names, phone numbers and addresses can be used as they are [17]. Password hashes are a risk only if the scheme behind them can be cracked, and the group's claim as reported does not name the scheme [17].
DataSuckers describes itself as financially motivated, with no political alignment. It posts detailed accounts of its intrusions on Telegram and invites victims, journalists and law enforcement to ask it for comment or samples [10]. Its recent named victims were Russian businesses [11]. In September it claimed Dodo Pizza, a chain operating some 1,500 restaurants across 28 countries [11]. Dodo afterwards acknowledged that the attackers may have reached customers' names, dates of birth, phone numbers, addresses, email addresses and what they had ordered [12]. At Tez Tour, a Russian tour operator, the group defaced the website and said it spent about two weeks inside the company's systems and took customer data [13]. Tez Tour confirmed the disruption but did not confirm a theft [13].
ATB got the sequence Tez Tour got: a defaced public site first, then a public account of the intrusion on Telegram [3][13][10]. A Ukrainian target after a run of Russian ones fits the money motive the group claims for itself [10][11]. It does not place the group. The hackers appear to communicate mainly in Russian, and their location is unclear, according to The Record [14].
What to watch
- An independent check of the Telegram samples against real ATB accounts, by researchers or Ukrainian authorities, would confirm or undercut ATB's denial.
- A revised ATB statement, or a password reset pushed to customers, would show the company found access beyond the defaced website.
- Whether DataSuckers finds a buyer for the database, or leaks the full set if no sale happens.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+30
- Incentives75
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
ATB, Ukraine's largest grocery store chain, confirmed Monday that it was hit by a cyberattack after hackers posted an extortion demand on its website.
- [2]
The hacker group DataSuckers claimed responsibility for the attack and demanded $400,000, threatening to publish data it claimed to have stolen from millions of ATB customers.
- [3]
A countdown timer for the ransom demand appeared on ATB's website but was later removed; the website was unavailable at the time The Record wrote its report.
- [4]
ATB denied that customer data had been compromised and temporarily took some online services offline for what it described as technical maintenance.
- [5]
"The temporary message displayed on the website did not affect the security of your data," ATB said.
- [6]
"The website remains fully under ATB's control, and all information is securely protected."
- [7]
In response to ATB's statement, the hackers published samples of the allegedly stolen data on their Telegram channel and said they would not leak the entire database but would instead sell it "for a substantial amount."
- [8]
DataSuckers published screenshots of what it said was stolen information; the authenticity of the data and the scale of the alleged breach could not be independently verified.
- [9]
ATB operates more than 1,300 stores and employs more than 60,000 people as of early 2026.
- [10]
DataSuckers describes itself as financially motivated rather than politically aligned, uses a Telegram channel to publish detailed accounts of the intrusions it claims, and invites victims, journalists and law enforcement agencies to contact it for comment or samples of allegedly stolen data.
- [11]
DataSuckers recently claimed attacks against several large Russian businesses, including, in September, Dodo Pizza, a Russian fast-food chain with about 1,500 restaurants in 28 countries.
- [12]
Dodo Pizza later confirmed that attackers may have accessed customer names, addresses, email addresses, phone numbers, dates of birth and order details.
- [13]
DataSuckers claimed an attack on Tez Tour, a major Russian tour operator, defaced its website, and said it spent about two weeks inside the company's systems and stole customer information; Tez Tour confirmed its website had been disrupted but did not confirm that data had been stolen.
- [14]
The hackers appear to communicate primarily in Russian, but their location is unclear.
- [15]
The $400,000 demand is about five cents per claimed customer record.
- [16]
Of the two prior DataSuckers victims named by The Record, one (Dodo Pizza) later confirmed possible access to customer data; the other (Tez Tour) confirmed only disruption.
- [17]
The group claimed to have obtained data belonging to 7.9 million customers, including names, phone numbers, email and physical addresses, password hashes, as well as employees' passport information and records of more than 11 million orders.
ReportedContestedSource: DataSuckers claim, reported by The Record2 sources— create a free account to open themView cited source
Sources
1 independent publisher whose own reporting we read for this story.
- therecord.mediaUkraine grocery chain ATB confirms cyberattack as hackers threaten to leak data
1 article · October 5, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Retail data breachesFollow
- Data ExtortionFollow