Flink refuses a corporate ransom after an Order Hub breach, so extortion actor "LPG Group" pivots to crowdfund-style individual extortion of at least 10,000 customers
A refused corporate ransom becomes individual extortion emails to at least 10,000 Flink customers in the Netherlands
Analysis
Flink, a quick-commerce grocery delivery service headquartered in Germany that also operates in the Netherlands and formerly in Austria and France (NL Times, 2026-09-25), confirmed a breach of an internal ordering system used in its "Order Hubs", the small decentralized city warehouses behind its promise of delivery in under thirty minutes (heise online, 2026-09-26). Flink's own customer notification, seen by RETAIL-NEWS, says an unauthorized person reached one of its internal systems with compromised credentials (RETAIL-NEWS, 2026-09-25); which credentials and how they were obtained is not stated. Flink told heise that the specific Order Hub instance involved has been identified and unauthorized access to it cut off (heise online, 2026-09-26). Attackers first approached Flink directly, demanding payment in the cryptocurrency ETH and promising to delete the data if paid. Flink states plainly that it does not negotiate with criminals and did not respond (heise online, 2026-09-26).
The extortion actor claiming the breach in its emails, self-named "LPG Group" and described by NL Times and heise as little-known (NL Times, 2026-09-25; heise online, 2026-09-26), claims to have obtained personal information on a million Flink customers and 13,000 workers; Flink has not confirmed that figure, though NL Times notes one million would represent roughly two-thirds of the customer base the company reported in June (NL Times, 2026-09-25). Rather than walk away after Flink's refusal to pay a corporate ransom, the group pivoted to mass-emailing individuals directly. At least 10,000 customers in the Netherlands received ransom notes (heise reports Germany was also targeted, though the scale there is unclear), and Flink says employees are being contacted directly too, each note demanding a small payment of 0.005 ETH (NL Times: the equivalent of EUR 11.80) toward a total of 100 ETH, which NL Times puts at just shy of EUR 237,300 and heise at roughly EUR 230,000, a discrepancy the two outlets' independent exchange-rate snapshots do not resolve. The outlets frame the 100 ETH differently: heise reads it as the sum customers are to raise, with the data deleted if it is reached and sold on the deep web if not, while NL Times reports the group saying it will delete all user data if the company itself pays 100 ETH; a 2 October 2026 deadline was mentioned (NL Times, 2026-09-25; heise online, 2026-09-26). The emails address recipients by name from a spoofed, Flink-resembling sender, which heise says may leave recipients easily unsettled (heise online, 2026-09-26). Flink says the copied data is limited to names, postal codes/delivery addresses, email addresses, phone numbers and, in individual cases, delivery notes such as floor or apartment details, and that passwords, payment card details and bank data were not affected (NL Times, 2026-09-25; heise online, 2026-09-26). Flink's own customer notice of 2026-09-25 was more cautious: it said such data could have reached the attacker and that there was no concrete indication that the additional order details, such as floor, doorbell name and delivery notes, had actually been accessed (RETAIL-NEWS, 2026-09-25).
Cybersecurity researcher Pim Takkenberg of Northwave called the crowdfunding-style extortion attempt exceptional, noting that ShinyHunters had previously extorted Dutch higher-education institutions that were clients of a hacked software system. "But I haven't seen individual consumers being approached before," Takkenberg told Dutch broadcaster NOS (Pim Takkenberg, Northwave, via NL Times, 2026-09-25). According to Flink, an abuse report to the mail provider the group uses has curbed the flood of messages for now, though the extortionists may look for other routes; Flink says only around 150 customers had contacted its support channels by the Saturday, leaving the number of customers contacted in Germany hard to estimate (heise online, 2026-09-26). Flink has notified Berlin's data protection authority and retained external IT forensics; heise's own coverage notes the company has not, contrary to an earlier report, engaged Germany's BSI (heise online, 2026-09-26). It has filed reports with police in Germany and the Netherlands (NL Times, 2026-09-25).
Cited evidence
If not, the data would, literally, be "sold on the deep web." The extortionists have thus turned to a kind of criminal crowdfunding against a company unwilling to pay. (translated from German)
But I haven't seen individual consumers being approached before
In these, which we were able to view in a sample, a so far rather unknown gang called "LPG Group" claims responsibility for the acts. (translated from German)
As a matter of principle, Flink does not make contact with criminals and does not conduct negotiations with them. (translated from German)
An unauthorised person gained access to one of the delivery service's internal systems with the help of compromised credentials (translated from German)
Updates2
Flink's own customer notification of 2026-09-25, which RETAIL-NEWS saw, says an unauthorized person reached one of the delivery service's internal systems with compromised credentials (RETAIL-NEWS, 2026-09-25). Which credentials were used, how they were obtained and whether multi-factor authentication applied are not stated. heise reports the 10,000 ransom notes for customers (heise online, 2026-09-26), and Flink says employees are also being contacted directly (NL Times, 2026-09-25). The outlets read the 100 ETH differently: heise as the sum customers are to raise (heise online, 2026-09-26), NL Times as what the group says the company itself would have to pay for all user data to be deleted (NL Times, 2026-09-25). Flink's customer notice was more cautious about data scope: it said there was no concrete indication that the additional order details had been accessed (RETAIL-NEWS, 2026-09-25).
In the extortion emails heise sampled, a so far rather unknown gang calling itself "LPG Group" claims responsibility for the acts, while heise describes the intruders as criminals unknown until now (heise online, 2026-09-26). According to Flink, the abuse report to the group's mail provider has curbed the flood of emails only for now, and it cannot be ruled out that the extortionists will look for other routes (heise online, 2026-09-26).
Sources3
Revision history
- Published 2026-09-27T0404Z-intel
- Correction 2026-10-04T0405Z-intel
Flink's own customer notification of 2026-09-25, seen by RETAIL-NEWS, says an unauthorised person reached an internal system with compromised credentials, which corrects the earlier statement that no initial-access vector had been disclosed. The 10,000 figure now says customers, the two outlets' differing readings of the 100 ETH demand are stated, and Flink's more cautious notice on the order details is carried.
Changed: title summary techniques sources evidence sourcing_note body
- Improvement 2026-10-21T0800Z-audit
LPG Group's role rests on its own claim of responsibility in the extortion emails heise sampled, and the curbing of the email flood is Flink's account and holds only for now. The takeaway treats such an email wave as evidence that an actor holds data from the breach, not as unrelated spam.
Changed: body evidence
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.