German fresh delivery platform Flink refuses ransom payment after being hacked, hackers turn to customers for Ethereum instead. By: www.120btc.com | 09/30/2026 05:32:01 Trade global markets with WEEX: Crypto · Stocks · Gold · ETFs Start with 0.1 USDT In the cryptocurrency community (120btc.CoM): The fresh delivery platform Flink, headquartered in Berlin, recently suffered an internal system breach. The attackers initially attempted to contact the management through a web form to demand a ransom in ETH. After the platform refused to compromise, the hackers' extortion strategy took a rare turn, directly targeting the platform's consumers. According to the latest ransom note, the hackers are demanding each affected user to pay 0.005 ETH (approximately 10 euros). The organization plans to raise a total of 100 ETH (about 230,000 euros) and has promised to destroy the data once the goal is reached; if fundraising fails, this batch of private information will be publicly sold on the dark web. Privacy at risk of exposure. The core breach of this security incident is located in Flink's internal order scheduling system. This system primarily serves the micro-fulfillment centers (Order Hubs) scattered throughout the city. The platform clarified that currently only one fulfillment center's access has been unauthorizedly compromised, and the internal team has urgently cut off the relevant ports, but the core data has been successfully copied by the hackers. The leaked information includes highly sensitive personal privacy, including names, delivery addresses, email addresses, and phone numbers of customers and employees. Some records even detail delivery notes such as floor numbers. Fortunately, core financial data such as account passwords and credit card information have not been compromised. Although the hacker group LPG Group boldly claimed in the ransom letter to have obtained the files of over 1 million customers and 13,000 employees, this large volume of data has not yet been cross-verified and confirmed by Flink. Even without payment passwords, these detailed addresses and contact information are sufficient to support criminals in launching highly realistic phishing attacks. Disguised official emails. The destructive power of this extortion operation has first manifested in the Dutch market. According to Flink, at least 10,000 local users have received customized ransom emails. The hacker organization LPG Group has surfaced in this operation, employing highly deceptive tactics: the emails not only address customers by their real names but also disguise the sender's address to resemble an official one. In their negotiation tactics, the organization attempts to disguise the extortion as "purely a business act," shifting the focus of the conflict onto the Flink management for refusing to pay the ransom. The end of the letter even thoughtfully includes practical tutorials on purchasing and transferring cryptocurrency assets, provocatively suggesting victims forward the email to the platform to exert public pressure. From the scale of victims in Germany, since Flink has reported abuse to the email service provider, the spread of the ransom letters has been temporarily curtailed. As of last Saturday, the German customer service department had only received about 150 related complaints, and the platform had urgently sent a risk warning to all users last Friday. Whether the hackers will switch to other communication channels to continue their harassment remains a pressing security concern. Ethereum price. 8.51% Past 30 days Ethereum is currently trading at 2676.72 USD. Over the past 30 days, Ethereum has risen 8.51%. Learn more about Ethereum. This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations. You may also like. Contents. 09/30/2026 09/29/2026

Flink hackers demand payments directly from customers after data breach. by Jason Phillips Security News Published: 2026 September 28, 09:23 Hackers targeting grocery delivery company Flink have taken an unusual approach to extortion by demanding cryptocurrency payments directly from customers whose personal information was exposed in a recent data breach. Flink confirmed that an unauthorized party gained access to one of its internal systems, exposing customer information including names, email addresses, postal addresses and telephone numbers. Some affected records also contained delivery details such as floor numbers, names displayed on doorbells and individual delivery instructions. The company said passwords were not compromised. Billing information, bank account details and payment card information were also unaffected, according to Flink. A newly emerged cybercrime operation calling itself LPG Group has claimed responsibility for the attack. The group says it obtained information belonging to more than one million Flink customers and 13,000 employees, although Flink has not confirmed those figures. Instead of limiting its pressure campaign to the company, LPG Group has started contacting individuals whose information was allegedly stolen. Customers have received emails demanding 0.005 ETH, worth roughly €10 to €12 at the time of reporting, in exchange for keeping their information from being sold on the dark web. The attackers have also demanded 100 ETH from Flink, worth approximately €238,000, and claim they will delete the stolen information if the larger payment is made. Their messages give victims an October 2 deadline and encourage recipients to forward the ransom demand to Flink to increase pressure on the company. This approach adds another layer to the traditional ransomware extortion model. Rather than relying only on pressure against the breached organization, the attackers are attempting to turn its customers into additional sources of ransom payments while simultaneously using their concerns to pressure Flink. Flink says it is aware that criminals are contacting customers and employees and has explicitly warned affected individuals not to respond or send money. The company blocked the unauthorized access after discovering the incident and introduced additional security measures. External IT forensic and cybersecurity specialists are assisting with an investigation into the breach. Flink has also reported the incident to Germany's data protection authority and law enforcement, with reports filed with police in Germany and the Netherlands. How the attackers initially obtained access remains less certain. Reporting has linked the intrusion to compromised employee credentials, but Flink has not publicly provided a detailed technical explanation of how those credentials were obtained.