Rapid grocery delivery service Flink has confirmed a major data breach affecting approximately one million customers and 13,000 workers across Germany and the Netherlands. The breach, claimed Friday by a hacker collective calling itself LPG Group, compromised names, postal codes, email addresses, phone numbers, and delivery instructions. Flink stressed that account passwords, billing information, bank account details, and payment cards were not compromised.
The total number of affected customers represents roughly two-thirds of Flink's customer base, according to figures the company released in June. The company has reported the incident to the German Data Protection Authority and filed police reports in both Germany and the Netherlands.
What makes this breach unusual is what happened next: rather than simply demanding payment from Flink, the LPG Group began contacting individual customers and workers directly. Victims received emails demanding 0.005 ETH (approximately €11.80) in cryptocurrency for the deletion of their personal data. The group also demanded a payment of 100 ETH (nearly €237,300) from Flink itself, with a deadline of October 2.
Cybersecurity experts described the direct-to-consumer extortion approach as highly unusual. "I haven't seen individual consumers being approached before," said Pim Takkenberg, a cybersecurity expert at Northwave, in an interview with NOS. RTL Nieuws tech journalist Daniel Verlaan noted that more companies are refusing to pay ransom demands, which may be driving hackers toward this new revenue model.
The origins of the LPG Group remain unclear. An earlier ransomware variant linked to the Russian-backed Wizard Spider group uses a file named lpg.dll, raising questions about whether the group's naming is coincidental or deliberate. Flink has advised affected customers and workers not to respond to ransom messages or make any payments.
Founded five years ago during the coronavirus pandemic, Flink operates in dozens of municipalities across the Netherlands, including 24 of the 25 largest cities.
