German Fresh Delivery Platform Flink Refuses Ransom Payment After Being Hacked, Hackers Turn to Customers for Ethereum Instead

In the cryptocurrency community (120btc.CoM): The fresh delivery platform Flink, headquartered in Berlin, recently suffered an internal system breach. The attackers initially attempted to contact the management through a web form to demand a ransom in ETH. After the platform refused to compromise, the hackers' extortion strategy took a rare turn, directly targeting the platform's consumers.

According to the latest ransom note, the hackers are demanding each affected user to pay 0.005 ETH (approximately 10 euros). The organization plans to raise a total of 100 ETH (about 230,000 euros) and has promised to destroy the data once the goal is reached; if fundraising fails, this batch of private information will be publicly sold on the dark web.

Privacy at Risk of Exposure

The core breach of this security incident is located in Flink's internal order scheduling system. This system primarily serves the micro-fulfillment centers (Order Hubs) scattered throughout the city. The platform clarified that currently only one fulfillment center's access has been unauthorizedly compromised, and the internal team has urgently cut off the relevant ports, but the core data has been successfully copied by the hackers.

The leaked information includes highly sensitive personal privacy, including names, delivery addresses, email addresses, and phone numbers of customers and employees. Some records even detail delivery notes such as floor numbers. Fortunately, core financial data such as account passwords and credit card information have not been compromised. Although the hacker group LPG Group boldly claimed in the ransom letter to have obtained the files of over 1 million customers and 13,000 employees, this large volume of data has not yet been cross-verified and confirmed by Flink. Even without payment passwords, these detailed addresses and contact information are sufficient to support criminals in launching highly realistic phishing attacks.

Disguised Official Emails

The destructive power of this extortion operation has first manifested in the Dutch market. According to Flink, at least 10,000 local users have received customized ransom emails. The hacker organization LPG Group has surfaced in this operation, employing highly deceptive tactics: the emails not only address customers by their real names but also disguise the sender's address to resemble an official one.

In their negotiation tactics, the organization attempts to disguise the extortion as "purely a business act," shifting the focus of the conflict onto the Flink management for refusing to pay the ransom. The end of the letter even thoughtfully includes practical tutorials on purchasing and transferring cryptocurrency assets, provocatively suggesting victims forward the email to the platform to exert public pressure.

From the scale of victims in Germany, since Flink has reported abuse to the email service provider, the spread of the ransom letters has been temporarily curtailed. As of last Saturday, the German customer service department had only received about 150 related complaints, and the platform had urgently sent a risk warning to all users last Friday. Whether the hackers will switch to other communication channels to continue their harassment remains a pressing security concern.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.