The Flink Breach: When Attackers Extort Your Customers Directly

NL Times reported on September 25, 2026 that Flink, a quick-commerce grocery delivery company, stated: "Unauthorized individuals have gained access to data in one of our internal systems." According to that report, affected data included names, postal codes, email addresses, phone numbers, and delivery instructions, while account passwords, billing information, bank account details, and payment cards were not compromised. Flink said the access was immediately blocked and that it reported the matter to the German data protection authority and filed police reports in Germany and the Netherlands.

The attackers, calling themselves LPG Group, sent extortion emails to individuals demanding 0.005 ETH each, reported as roughly 12 euros, with an October 2 deadline, and demanded 100 ETH from Flink itself. The attackers claimed to hold data on about one million customers and 13,000 workers. That figure is theirs; Flink has not confirmed it. NOS also reported on the incident. How access was obtained has not been confirmed by the company.

Traditional extortion targets the company: pay, or the data is published. Emailing individuals changes the dynamics in three ways.

The attacker controls first contact. Many customers learn of the breach from the extortion email. Their first impression of the incident is fear and an attacker's framing.

It scales pressure through volume. Small individual demands are designed to seem cheaper than the risk, and even a low payment rate generates money and publicity.

It creates a phishing wave. Once customers expect messages about the breach, copycat scammers and the attackers themselves can send convincing follow-ups asking for payment or credentials. Delivery instructions and addresses make those messages more believable.

• Pre-approved customer messages for a data breach, written in advance with legal review, so a notice can go out within hours rather than days.
• Clear, specific guidance. Do not pay. Do not reply. We will never ask for payment or passwords by email. Here is how to verify a message is from us.
• A verification page on your own domain listing official communications about the incident, so customers can check what is real.
• Support readiness. Brief support teams with scripts and escalation paths before the customer notice goes out.
• Email authentication. Strong sender authentication on your domains makes impersonation of your own notices harder.
• Coordination with authorities, who may track the extortion campaign across victims.

The data in this case, contact details and delivery instructions, sits in operational systems that many staff and tools can read. That is typical: customer contact data is accessed widely because many workflows need it. Limiting which internal systems hold full contact records, logging access to bulk exports, and alerting on unusual extraction volumes all reduce the size of a breach like this, even when the initial access cannot be prevented.

• Do not stay silent while waiting for full scope. An initial notice with what is known, and what customers should do, is better than a complete notice after the attacker's deadline.
• Do not overstate or understate. Say what data was affected as far as you know, and correct it if the picture changes.
• Do not include links in breach notices unless they point to a page on your own well-known domain. Customers are primed to click, and scammers will imitate your notice.
• Do not engage the attackers without advice. Any contact with an extortion group should go through legal counsel and, where appropriate, specialists and law enforcement.

When extortion emails reach customers, the communications workstream becomes as urgent as containment. Assign it an owner from the first hour, capture copies of the extortion messages as evidence, and track them as indicators, including sender addresses and wallet addresses, to share with authorities and to filter follow-on messages.