Flink cyberattack and customer extortion

The grocery delivery service Flink confirmed a cyberattack involving unauthorized access to an internal ordering system at a local warehouse. The breach, reportedly facilitated by the credentials of a former employee, resulted in the theft of personal data including names, email addresses, phone numbers, and delivery addresses.

A hacking collective identified as the LPG Group employed a ‘triple extortion’ tactic. In addition to a larger demand of 100 ETH (approximately 230,000 to 238,000 EUR) made to Flink to delete the stolen data, the group contacted approximately one million customers directly via email. These individual extortion attempts demanded small payments of roughly 0.005 ETH (approximately 10 to 15 EUR) per person to prevent the release of personal information on the dark web.

Flink stated that passwords and financial details were not affected and refused to negotiate with the criminals. As of early October, blockchain analysis indicated that no customers had paid the individual ransoms. Cybersecurity experts advised against payment, noting that there is no guarantee data would be deleted, while the incident has been noted by observers as an example of growing ‘data leak fatigue’ among consumers.