On October 5, 2026, ATB, Ukraine's largest grocery chain, confirmed a cyberattack after a group calling itself DataSuckers posted a $400,000 extortion demand with a countdown timer on the retailer's website, according to The Record. The group claims it holds data on 7.9 million customers: names, phone numbers, emails, physical addresses, password hashes, employee passport data and records of more than 11 million orders. ATB denies that customer data was compromised. It describes the website message as a temporary matter tied to technical maintenance. The Record notes that the authenticity and scale of the alleged breach could not be independently verified.
That uncertainty is the point of this piece. Whether or not the data is real, the episode shows how Ukraine's cyber framework handles a private company that says one thing while criminals say another.
What is known, and what is not
The verified facts are thin. ATB confirmed an incident, took some online services offline and says the site 'remains fully under ATB's control.' DataSuckers responded by posting samples on Telegram and saying it would sell the database rather than leak it. The Record describes the group as financially motivated rather than politically aligned. It writes in Russian and has recently targeted Russian businesses, including the pizza chain Dodo and the tour operator Tez Tour.
This matters because Ukraine's cyber debate is dominated by state-sponsored attacks on the grid, telecoms and government. This case looks like ordinary criminal extortion. It hits a company whose operations are already strained by the war: The Record reports that Russian strikes have destroyed hundreds of ATB locations and damaged warehouses. A retailer under that pressure is exactly the kind of target a profit-seeking crew expects to pay quickly.
The case for stricter breach rules
The strongest argument for tougher mandates is the information asymmetry. Customers cannot tell whether ATB's denial is accurate, and a company has every incentive to describe an incident as 'maintenance.' A mandatory, time-bound notification duty to a regulator and to affected individuals would remove that discretion. It is the logic behind the GDPR's breach rules, which Ukraine's pending data protection bill is meant to approximate.
Ukraine does not have that duty for ordinary personal data. Linklaters' Data Protected guide states that Ukrainian legislation does not require breach reporting to authorities or data subjects. The supervisory authority is the Ombudsman's Office, and the administrative fines it can rely on are small: up to roughly €110 to €320 for the listed offences. The same guide says Draft Law 8153, submitted on October 25, 2022 to align Ukraine with the GDPR, was adopted at first reading on November 20, 2024 and still awaits final adoption.
Why the cyber law does not close the gap
Ukraine's cyber architecture rests on the Law on the Basic Principles of Cybersecurity (No. 2163-VIII, 2017), which makes owners of critical infrastructure responsible for cyber defence of their systems and for reporting incidents to CERT-UA. A grocery chain may qualify as critical infrastructure in some sectoral designations, but customer-data theft from a retailer is not what the regime was built around. A newer law, summarized by Aster, took effect on April 20, 2025. It focuses on public-sector entities, operators of critical information infrastructure and foreign vendors serving public bodies. It created a multi-tier incident response system coordinated through SSSCIP and CERT-UA.
The result is a split. State systems face reporting duties and security authorization. A private retailer holding the phone numbers and addresses of millions of citizens faces, for now, no clear statutory obligation to tell anyone. The Rada has been reviewing the architecture: its Committee on Digital Transformation has discussed the basic principles of cybersecurity in Ukraine. But a committee discussion does not create a duty.
A proportionate response
The pro-innovation instinct is not to answer this incident with sweeping new rules written in a hurry. Ukraine's digital economy is one of its few growth stories, and martial-law capacity constraints are real at the regulator and at mid-sized firms. Three narrower steps would deliver most of the benefit.
- Finish Draft Law 8153 with a risk-based notification threshold. Require notice to the regulator and affected people only when a breach is likely to cause real harm, such as exposed credentials or identity documents. Do not require it for every technical hiccup. That limits notification fatigue and compliance cost for small firms.
- Make the penalty credible but scaled. Fines of a few hundred euros will not move a company with more than 1,300 stores. Penalties tied to turnover and to the company's conduct after the breach, for example concealment versus prompt disclosure, reward honesty instead of punishing every victim.
- Do not criminalise being extorted. Ransom victims are victims. Safe harbours for prompt, good-faith reporting to CERT-UA encourage the cooperation that helps defenders, including sharing indicators of compromise so other retailers can block the same intrusion.
The password hashes point is also practical. If hashes were taken, the sensible consumer response is to change passwords wherever they were reused. That advice costs nothing and does not depend on resolving the dispute over ATB's denial.
What to watch
Two tests will show whether the alleged breach is real. The first is whether independent researchers can match the Telegram samples to ATB's systems or customer base. The second is whether ATB gives customers a specific, checkable account of what its 'maintenance' covered. If the data is real, ATB's initial statement will look like precisely the discretionary spin that a notification rule exists to prevent. If it is not, the episode shows how cheaply a criminal crew can pressure a company by posting a countdown timer.
Either way, wartime resilience cannot be measured only by how well the grid and government networks hold. It also depends on whether the ordinary firms that feed the country have clear, proportionate rules and incentives to tell the truth when something goes wrong.