Incident analysis · 15 Oct 2026
The ATB website attack: what is known, what is not
Ukraine's largest grocery chain had its website replaced by a $400,000 ransom note. The timeline, the attackers' unverified claims against public figures, and what every consumer website can learn.
- ≈ 15:15The site stops working. A black screen reads “АТБ, ваші дані у нас” (“ATB, your data is with us”), with a two-hour countdown and a demand for $400,000 in cryptocurrency.
- ≈ 15:25About ten minutes later the message disappears.
- 18:30The site is still offline for “technical work”. Stores keep trading; no disruption to tills is reported.
What the attackers claim — unverified
- Data on 7.9 million customers: names, phone numbers, emails, addresses and password hashes.
- Passport data of 127,000 employees, an 11.4-million-order history and details of 50,300 suppliers.
None of this has been independently confirmed. Forbes Ukraine compared two of the numbers with public figures and found them inflated:
| Metric | Claimed | Reported |
|---|---|---|
| Employees | 127,000 | ≈ 60,000 |
| Suppliers / partners | 50,300 | ≈ 1,000 |
Source: Forbes Ukraine (5 Oct 2026). Each pair has its own scale.
What ATB says
Serhiy Demchenko, ATB's head of corporate communications, said an attempted attack on company resources did take place, that no data leak occurred, and that customers' personal data was never stored on the company's online resources.
What experts told Forbes Ukraine
- Nazar Tymoshyk (UnderDefense): a website like this can be restored in a day; if the stores keep working, the impact is minor. He put the average cost of recovering from an attack in Ukraine at $0.6–1 million, without estimating ATB's losses.
- Serhiy Kharyuk (AmonSul): recovery time is the tell — a day or two suggests the damage is smaller than claimed; a week suggests restoring from old backups.
- Oleksiy Panasiuk (Zakaz.ua): for a grocer, uninterrupted tills matter most, and none were reported down.
- Ransom demanded on the defaced page
- $400kForbes Ukraine
- Average cost of recovering from an attack in Ukraine (estimate)
- $0.6–1MN. Tymoshyk, via Forbes Ukraine
- Share of ATB's 2024 turnover from online sales
- ≈ 1%Forbes Ukraine
Our reading
Analysis — Altumptic's interpretation. We do not know how the site was attacked.
- A defacement is not a breach — but it is sold as one. Showing a note on the homepage takes control of the website, not necessarily of customer data. Attackers count on the public not seeing the difference.
- Keeping customer data off the public web tier pays off here. If ATB's statement holds, that separation is exactly what limited the damage.
- Inflated numbers are a pressure tactic. Figures that clash with public facts are a reason to stay calm, not proof that nothing was taken.
What to do
If you are a customer: expect phishing that uses the news — calls, SMS or emails “from ATB” asking you to confirm details. If you reused your ATB password elsewhere, change it there.
If you run a consumer website:
- Keep customer data out of the systems that serve your public website.
- Put the site admin behind single sign-on with two-factor authentication, and patch the CMS and plugins.
- Watch your own homepage: alert within minutes when its content changes unexpectedly.
- Rehearse restoring the site from a clean backup and time it.
- Prepare the customer statement before you need it, and publish a security contact (security.txt).
Sources
- Forbes Ukraine — Hackers took down ATB's website and demanded $400,000 (5 Oct 2026)
- Forbes Ukraine — ATB confirmed the attack and denied a data leak (5 Oct 2026)
- Fakty — ATB denied the hack and theft of millions of customers' data (5 Oct 2026)
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.