CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

LPG Group

actor · actor:lpg-group

Previously undocumented extortion actor that breached an internal Order Hub ordering system at grocery-delivery service Flink and, after Flink refused a corporate Ethereum ransom, pivoted to directly extorting at least 10,000 individual customers and employees in a collective-threshold 'crowdfunding' scheme (heise online / NL Times, 2026-09-25/26).

Coverage
1
first 2026-09-27 → last 2026-10-04
Latest activity
2026-09-27
A refused corporate ransom becomes individual extortion emails to at least 10,000 Flink customers in the…
Peak priority
routine
1 routine
Targets
retail
sectors: retail · regions: europe, dach
Sources cited
3
3 hosts

Defender insights

What each entry about LPG Group tells a defender to do, newest first.

2026-09-27ROUTINEA refused corporate ransom becomes individual extortion emails to at least 10,000 Flink customers in the Netherlands

Story timeline

  1. 2026-09-27Flink refuses a corporate ransom after an Order Hub breach, so extortion actor "LPG Group" pivots to crowdfund-style individual extortion of at least 10,000 customers
    active-threatsA refused corporate ransom becomes individual extortion emails to at least 10,000 Flink customers in the Netherlands

Hunting pivots

Tags
data-breachorganized-crimephishing
ATT&CK techniques (2 across 5 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts
  • PersistenceValid Accounts
  • Privilege EscalationValid Accounts
  • StealthValid Accounts
  • ImpactFinancial Theft

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-27/flink-lpg-group-crowdfund-extortion-order-hub-breach · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-27/flink-lpg-group-crowdfund-extortion-order-hub-breach · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-27/flink-lpg-group-crowdfund-extortion-order-hub-breach · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-27/flink-lpg-group-crowdfund-extortion-order-hub-breach · ATT&CK page ↗

Impact TA0040

T1657Financial Theft×1

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.

Evidence: 2026-09-27/flink-lpg-group-crowdfund-extortion-order-hub-breach · ATT&CK page ↗

Entries about LPG Group (1)

2026-09-27 · view entry permalink →

ROUTINEupdatedNATOB1

Flink, a quick-commerce grocery delivery service headquartered in Germany that also operates in the Netherlands and formerly in Austria and France (NL Times, 2026-09-25), confirmed a breach of an internal ordering system used in its "Order Hubs", the small decentralized city warehouses behind its promise of delivery in under thirty minutes (heise online, 2026-09-26). Flink's own customer notification, seen by RETAIL-NEWS, says an unauthorized person reached one of its internal systems with compromised credentials (RETAIL-NEWS, 2026-09-25); which credentials and how they were obtained is not stated. Flink told heise that the specific Order Hub instance involved has been identified and unauthorized access to it cut off (heise online, 2026-09-26). Attackers first approached Flink directly, demanding payment in the cryptocurrency ETH and promising to delete the data if paid. Flink states plainly that it does not negotiate with criminals and did not respond (heise online, 2026-09-26).

The extortion actor behind the breach, self-named "LPG Group" and described by NL Times and heise as little-known (NL Times, 2026-09-25; heise online, 2026-09-26), claims to have obtained personal information on a million Flink customers and 13,000 workers; Flink has not confirmed that figure, though NL Times notes one million would represent roughly two-thirds of the customer base the company reported in June (NL Times, 2026-09-25). Rather than walk away after Flink's refusal to pay a corporate ransom, the group pivoted to mass-emailing individuals directly. At least 10,000 customers in the Netherlands received ransom notes (heise reports Germany was also targeted, though the scale there is unclear), and Flink says employees are being contacted directly too, each note demanding a small payment of 0.005 ETH (NL Times: the equivalent of EUR 11.80) toward a total of 100 ETH, which NL Times puts at just shy of EUR 237,300 and heise at roughly EUR 230,000, a discrepancy the two outlets' independent exchange-rate snapshots do not resolve. The outlets frame the 100 ETH differently: heise reads it as the sum customers are to raise, with the data deleted if it is reached and sold on the deep web if not, while NL Times reports the group saying it will delete all user data if the company itself pays 100 ETH; a 2 October 2026 deadline was mentioned (NL Times, 2026-09-25; heise online, 2026-09-26). The emails address recipients by name from a spoofed, Flink-resembling sender, which heise says may leave recipients easily unsettled (heise online, 2026-09-26). Flink says the copied data is limited to names, postal codes/delivery addresses, email addresses, phone numbers and, in individual cases, delivery notes such as floor or apartment details, and that passwords, payment card details and bank data were not affected (NL Times, 2026-09-25; heise online, 2026-09-26). Flink's own customer notice of 2026-09-25 was more cautious: it said such data could have reached the attacker and that there was no concrete indication that the additional order details, such as floor, doorbell name and delivery notes, had actually been accessed (RETAIL-NEWS, 2026-09-25).

Cybersecurity researcher Pim Takkenberg of Northwave called the crowdfunding-style extortion attempt exceptional, noting that ShinyHunters had previously extorted Dutch higher-education institutions that were clients of a hacked software system. "But I haven't seen individual consumers being approached before," Takkenberg told Dutch broadcaster NOS (Pim Takkenberg, Northwave, via NL Times, 2026-09-25). Abuse reporting to the group's mail provider curtailed the flood of messages, and only around 150 customers had proactively contacted Flink's support line as of reporting, leaving the true scale of contacted individuals, particularly in Germany, unclear. Flink has notified Berlin's data protection authority and retained external IT forensics; heise's own coverage notes the company has not, contrary to an earlier report, engaged Germany's BSI (heise online, 2026-09-26). It has filed reports with police in Germany and the Netherlands (NL Times, 2026-09-25).

If not, the data would, literally, be "sold on the deep web." The extortionists have thus turned to a kind of criminal crowdfunding against a company unwilling to pay. (translated from German)

heise online 2026-09-26

But I haven't seen individual consumers being approached before

Pim Takkenberg, Northwave, via NL Times

As a matter of principle, Flink does not make contact with criminals and does not conduct negotiations with them. (translated from German)

Flink, quoted by heise online

An unauthorised person gained access to one of the delivery service's internal systems with the help of compromised credentials (translated from German)

RETAIL-NEWS Deutschland (reporting Flink's customer notification)
Correctionrun 2026-10-04T0405Z-inteltitlesummarytechniquessourcesevidencesourcing_notebody

Flink's own customer notification of 2026-09-25, which RETAIL-NEWS saw, says an unauthorized person reached one of the delivery service's internal systems with compromised credentials (RETAIL-NEWS, 2026-09-25). Which credentials were used, how they were obtained and whether multi-factor authentication applied are not stated. heise reports the 10,000 ransom notes for customers (heise online, 2026-09-26), and Flink says employees are also being contacted directly (NL Times, 2026-09-25). The outlets read the 100 ETH differently: heise as the sum customers are to raise (heise online, 2026-09-26), NL Times as what the group says the company itself would have to pay for all user data to be deleted (NL Times, 2026-09-25). Flink's customer notice was more cautious about data scope: it said there was no concrete indication that the additional order details had been accessed (RETAIL-NEWS, 2026-09-25).

incident27 Sep 04:32Zmulti-sourceOpen finding →
Sources: heise online · NL Times · RETAIL-NEWS Deutschland

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • heise.de1 (33%)
  • nltimes.nl1 (33%)
  • retail-news.de1 (33%)
All cited sources (3)