Advisories
ATB Grocery Chain Hit by DataSuckers Cyberattack, $400k Ransom Demand
Ukraine’s largest grocery chain ATB confirmed a cyberattack after the hacker group DataSuckers posted a ransom demand on its website. The group claims to have exfiltrated data for 7.9 million customers and threatens to publish it unless a $400,000 payment is made. Defenders should verify data integrity, conduct forensic reviews, and reinforce security controls.
What happened
ATB, Ukraine’s largest grocery chain, confirmed a cyberattack after the hacker group DataSuckers posted a ransom demand on the retailer’s website. The group claimed to have exfiltrated personal data for 7.9 million customers and order records for over 11 million transactions, and threatened to sell or publish the information unless a $400,000 payment was made.
Impact
ATB denied that customer data had been compromised, but the hackers posted screenshots of alleged stolen records on Telegram. The breach could expose names, phone numbers, email addresses, physical addresses, password hashes, employee passport details, and order histories. The company temporarily disabled some online services for “technical maintenance.”
What defenders should do
- Verify the authenticity of the leaked data by cross‑checking hashes and employee records against internal logs.
- Conduct a rapid forensic review of ATB’s web servers, database, and employee accounts to identify any exfiltration vectors.
- Implement or reinforce network segmentation and MFA for all remote access points.
- Notify affected customers and regulators in accordance with Ukrainian data‑protection law if a breach is confirmed.
- Monitor the dark web and Telegram for additional data dumps or ransom demands.
Mitigation and response
ATB should immediately patch any known vulnerabilities in its web platform, enforce strict password policies, and deploy intrusion‑detection systems. If the data is confirmed compromised, a coordinated incident‑response plan, including legal counsel and law‑enforcement notification, is essential.
Lessons for the sector
Large retail chains operating in conflict zones must maintain robust incident‑response plans and regularly test their ability to detect and contain web‑based attacks. The use of public ransom demands on company websites can accelerate damage and erode customer trust.
Related articles
Osaka Metropolitan University Ransomware Attack Halts 500 Servers, Cancels Classes
A suspected ransomware attack disabled 500 servers at Osaka Metropolitan University, shutting down internal network, email, and key academic systems, forcing class cancellations. The incident exposed personal data of ~130,000 users and prompted investigation by external specialists. Defenders should review ransomware defenses, ensure backups, and monitor for similar disruptions.
Read briefing
Denmark CPR Data Breach: 8.8M Records Exposed via Private Company Account
Unauthorized actors accessed names, addresses and CPR numbers for 8.8 million people in Denmark’s Central Person Register through a private company’s legitimate lookup account. The breach, lasting about ten days in September, exposed sensitive personal identifiers that can fuel identity theft.
Read briefing
Denmark CPR Registry Breach Exposes 8.8 Million Citizens' Personal Data
In September 2026 a breach of Denmark’s Central Population Register (CPR) exposed names, addresses, CPR numbers and other personal details for 8.8 million individuals. The attack leveraged a private company’s legitimate access and brute‑forced valid CPR identifiers. Defenders should audit access controls, monitor for credential misuse, and enforce MFA on registry interfaces.
Read briefing
Frontline Education breach exposes school district employee data via third-party software flaw
Frontline Education told school districts that attackers used a vulnerability in a third-party application to access part of its environment and steal employee records, including Social Security numbers. The company identified the issue on August 14, 2026, remediated it, and engaged law enforcement, but has not named the affected product or the initial access date. Districts should treat the incident as a potential PII exposure and begin credential, identity, and monitoring follow-up.
Read briefing