Ukrainian grocery chain ATB has confirmed it suffered a cyberattack, according to The Record from Recorded Future News, with the attackers now threatening to publish data they claim to have stolen from the company.

The confirmation makes ATB the latest major Ukrainian enterprise to disclose a security incident, and the extortion threat attached to it signals the attackers' intent to pressure the retailer publicly rather than quietly monetize access.

What has ATB confirmed?

ATB has acknowledged that a cyberattack took place. Hackers behind the incident are threatening to leak data they say they obtained from the company's systems. The company has not, at the time of reporting, detailed the full scope of the intrusion.

Why does this matter for enterprise security teams?

The incident follows a familiar extortion playbook: breach a target, claim access to sensitive data, then threaten publication if demands are not met. For a large retail operator, data at stake in such scenarios typically includes customer, employee, operational and supplier information, which can carry regulatory and reputational consequences if released.

Security teams monitoring the region should treat the disclosure as a reminder that extortion attempts increasingly accompany — or replace — encryption-based attacks, and that incident-response plans need to cover leak-threat scenarios, not just recovery.

This is a developing story. Watch for ATB's follow-up statements on the scope of the breach, the categories of data involved, and any deadlines set by the attackers.

This article is based on reporting currently available; additional details were not disclosed at press time.