Berlin-based grocery delivery company Flink has confirmed that unauthorized people accessed customer data in one of its internal systems. The report is no longer carried only by Pravda-network sites: NL Times, de Volkskrant, Tagesspiegel and Retail-News have all confirmed it independently, citing Flink's own statements and its breach notification emails. A group calling itself LPG Group claims it took data on about 1 million customers and 13,000 employees. It has emailed alleged victims directly, demanding about €10 to €15 each in Ethereum, and has asked Flink for 100 ETH to delete everything. Flink has not confirmed the 1 million figure or the employee count. Both numbers come from the attackers.
What Happened
On Friday 25 September 2026, people who said they were Flink customers began receiving extortion emails. According to Tagesspiegel, the emails used recipients' first and last names, which suggests the attackers hold full customer records and not just email lists. Flink sent its own notification to customers almost five hours later (Tagesspiegel). The company told NL Times it knew customers were being contacted directly.
Flink's public statement, reported by NL Times and de Volkskrant, says: "Unauthorized individuals have gained access to data in one of our internal systems... The access in question was immediately blocked, additional security measures have been taken, and a comprehensive investigation has been launched in collaboration with external forensic IT and cybersecurity experts." Flink told NL Times it has reported the incident to the German data protection authority and filed a police report. Pravda Germany says Flink contacted law enforcement in both the Netherlands and Germany. Flink is notifying customers in both countries. The company declined to answer further questions from de Volkskrant, saying it did not want to interfere with the authorities' investigation.
Accounts differ on who is behind the attack. The extortion emails are signed "LPG Group" (NL Times), and Tweakers uses that name. NOS describes the group as "previously unknown". Tagesspiegel notes that the Twitter/X account given in the ransom note was created in September 2026 and has very few followers, which fits a new or rebranded operation. There is no public link to any established ransomware brand.
The ransom figures vary between reports. Per-victim demands: - 0.005 ETH, which NL Times converts to €11.80 and Tagesspiegel to about €10 - €10 to €15 in crypto, according to NOS as cited by de Volkskrant - €10 to €11, according to Pravda Germany
The demand to Flink is 100 ETH. Tagesspiegel puts that at about €235,000 and Pravda Germany at about €237,000. Pravda Germany alone reports a payment deadline of 2 October, and no other outlet has confirmed it.
What Was Taken
Flink's own notification, quoted by Retail-News, says these data types may be affected: - names - email addresses - postal addresses - phone numbers
Order-related data may also be exposed: floor and entrance details, names on doorbells, individual delivery notes and order details. Flink says it has "no concrete indications" that this extra order data was accessed, but it cannot yet rule that out. NL Times, reporting Flink's comments, lists delivery instructions among the stolen data. The Flink statements quoted by NL Times and Retail-News say passwords, billing information, bank details and payment cards were not affected.
On volume, the attackers claim about 1 million customers and 13,000 employees. NL Times, Tagesspiegel and Pravda Germany all repeat that claim, and Flink has confirmed neither number. NL Times notes that 1 million would be about two-thirds of the customer base Flink reported in June. That makes the claim plausible, but it is still unverified. De Volkskrant reports that employee names, email addresses and home addresses were among the data taken, and that some employees have also received individual ransom demands.
Why It Matters
Charging each victim a small amount is a growing extortion model. The attackers skip the single negotiation with the company and turn the stolen database itself into a list of targets. A €10 demand sent to a million people only needs a small fraction to pay to add up to real money, and the pressure on the company rises with every customer complaint. De Volkskrant places the case alongside other large extortion-driven breaches this year, including the ShinyHunters attack on Dutch telecom provider Odido, which exposed 6 to 8 million current and former customers.
The data itself is well suited to follow-on fraud. Retail-News reports that Flink specifically warned customers that attackers could use the data for convincing emails, SMS messages or phone calls pretending to be Flink. Door-level delivery details such as floor, entrance and doorbell name also create a physical-world risk for customers, not just phishing exposure. Employee records add an insider-targeting angle for any future intrusion.
A note on unrelated reporting: three sources in this collection (Safeguard and two GitCode write-ups) cover CVE-2020-17518 and CVE-2020-17519. These are path traversal flaws in Apache Flink, the open-source stream processing engine. CVE-2020-17519 is in CISA's KEV catalog. Apache Flink has nothing to do with Flink the grocery company, and nothing links these CVEs to this breach. Defenders should not treat them as related because of the shared name.
The Attack Technique
According to Flink's customer notification, as reported by Retail-News, the attacker got into an internal system using compromised access credentials. Flink disabled that access after it spotted the first signs of the intrusion. De Volkskrant and Pravda Germany describe it as a "vulnerability" that has since been fixed. That wording is less specific than Flink's own email and is probably a paraphrase. Credential compromise is the best-supported explanation. Nobody has said how the credentials were obtained (for example infostealer malware, phishing or reuse) or which system was involved.
Nothing reported so far points to encryption or ransomware being deployed. This looks like a data theft and extortion operation, not a disruptive one.
What Organizations Should Do
- Enforce phishing-resistant MFA on every internal system that holds customer data. Include back-office tools, CRMs, support desks and data warehouses, not just production login pages. Compromised credentials against a single-factor internal system is the pattern here.
- Monitor for credential exposure. Check infostealer logs and breach dumps for employee and contractor accounts, and rotate or disable exposed credentials before someone uses them.
- Limit bulk data access. Put rate limits and alerts on large exports or unusual query volumes from internal systems, so that exfiltrating a full customer table triggers an alert quickly.
- Prepare direct-to-victim communications in advance. In this case the attackers' emails reached customers about five hours before Flink's. Keep pre-approved notification templates and a fast-send process ready so your message arrives first.
- Strip unneeded fields from operational datastores. Doorbell names, access notes and old order details don't need to sit in systems that many staff can reach. Minimize data, split it out, and expire it.
- Warn customers and staff about impersonation. Tell them clearly that they should not pay individual ransom demands, and that you will never ask for crypto or credentials by SMS, email or phone.
Sources: Hackers have stolen the data of a million Europeans from the Flink... | Individuals sent ransom notes after cybercriminals steal Flink cust... | Datenschutzvorfall bei Flink: Lieferdienst warnt vor Phishing und E... | Boodschappendienst Flink getroffen door digitale gijzeling, ook kla... | Flink: Hacker erpressen Kunden nach Datenklau Crime | CVE-2020-17519: Apache Flink Improper Access Control Vulnerability | Apache Flink REST 上传接口路径穿越漏洞（CVE-2020-17518）复现与解析 - AtomGit GitCode博客 | Apache Flink JobManager 日志接口路径穿越任意文件读取漏洞（CVE-2020-17519）原理剖析与复现实战 -...