Хочете будувати кар’єру в Data Science та AI? Vodafone Big Data Lab відкриває новий набір —>
Наталя ХандусенкоHot News
5 October 2026, 15:38
2026-10-05
Hackers tried to hack ATB website: what the company said
Ukrainian Telegram channels have reported an alleged hacking of the ATB retail chain's website. As evidence, the authors of the posts are distributing screenshots of the extortion and an archive file that allegedly contains customer data and internal company information. The text with the demanding message was indexed directly on the chain's official website section, in particular, at the delivery address.
The company confirmed that there was an attempted attack.
Ukrainian Telegram channels have reported an alleged hacking of the ATB retail chain's website. As evidence, the authors of the posts are distributing screenshots of the extortion and an archive file that allegedly contains customer data and internal company information. The text with the demanding message was indexed directly on the chain's official website section, in particular, at the delivery address.
The company confirmed that there was an attempted attack.
Timer, $400,000 and data leak threats
Screenshots circulating on social media show an interface in the style of a classic ransomware or ransomware message. On a black background with a red headline “ATB — your data is with us,” there is a countdown timer and a demand to pay $400,000 in cryptocurrency (USDT or BTC) within two hours.
The attackers claim that they managed to gain access to a large amount of data, including:
Personal data of 7.9 million customers (phone numbers, e-mails, names, addresses, password hashes);
Passport data of 127 thousand employees;
History of 11.4 million orders;
Contacts and details of 50.3 thousand suppliers;
68 thousand Active Directory accounts and 524 source code repositories in GitLab.
The hackers also claim to have completely destroyed all of the company's backups.
Signs of a subdomain attack and customer reactions
The text with the demanding message was indexed directly on the section of the network's official website, in particular at the delivery address [atbmarket.com/delivery](https://atbmarket.com/delivery). This may indicate that there was a defacement (replacement of page content) or a cyberattack on the website's infrastructure or its separate subdomain.
Regular customers have already noticed disruptions in the platform's operation when trying to place an order online.
What the company said
“Yes, there was indeed an attempted hacker attack on the company's resources. Fortunately, there was no data leak — no personal data of customers was stored on our resources at all. We are currently restoring work, and in the near future all resources will be fully operational,” Serhiy Demchenko, head of the corporate communications department of the ATB network, told dev.ua.
