If you have ever ordered groceries through Flink, you may have received an odd email demanding a small payment to keep your personal data off the dark web. Reports describe roughly 1 million records being auctioned and customers being hit with extortion demands of around €12. If you are wondering about the Flink data breach and what to do next, this checklist covers confirming exposure, locking down accounts and recognizing the scams that tend to follow.
What was stolen in the Flink breach
The attackers behind the incident, identified as the extortion group LPG Group, claim to have taken data belonging to more than one million shoppers and 13,000 employees. Our earlier report on LPG Group's ransom demands against Flink customers covers the group's claims in more detail.
The material we reviewed does not give a complete, verified list of every data field involved, so treat any detailed claims with caution. What is clear is that the attackers had enough customer contact information to email people directly. At a minimum, assume your email address and the identity details tied to your account could be in criminal hands. Reports also say Flink refused to pay the attackers, and that the stolen records were offered for auction.
Why a €12 ransom demand is harder to ignore
Most of us associate extortion with multi-million-dollar ransomware demands against large companies. A demand of roughly €12 per person works differently. It is small enough that some people might pay just to make the problem go away, and the attackers can send thousands of messages at once instead of negotiating with one victim.
That is the logic of a micro-ransom. The cost to each victim feels trivial, but multiplied across a large customer list it adds up. One report suggests the attackers hoped to collect more than €200,000 in total, and that nobody paid.
Security guidance quoted in coverage of the case is consistent: do not reply and do not pay. Replying can confirm that your address is live and monitored, which makes it more valuable to scammers. Paying funds the model and offers no guarantee that your data will be deleted. Once data has been copied, a criminal's promise to destroy it cannot be verified.
How to check if your Flink account was affected
Start with the evidence you already have.
- Look for the email. Search your inbox and spam folder for messages that mention Flink, your data, or a payment demand in cryptocurrency or euros. Receiving one is a strong sign your details were in the stolen set.
- Check your account email. If you used a separate or aliased address for Flink, note whether extortion messages arrived there.
- Watch official channels. Look for a notice from Flink itself rather than relying on screenshots shared on social media. If you want confirmation, contact Flink through its official app or website, not through a link in an email.
- Use a breach-notification service. Reputable tools that check whether your email appears in known leaks can tell you if your address has surfaced elsewhere. A clean result does not prove you were unaffected, since new dumps appear over time.
If you did not receive an extortion email, you may still have been exposed. Attackers do not always contact every victim.
Flink data breach: what to do to protect your accounts
Work through these steps in order of urgency.
- Do not engage with the extortion email. Do not reply, click links, open attachments or pay. Mark it as phishing in your email client and delete it.
- Change your Flink password. Choose a long, unique password that you do not use anywhere else.
- Replace reused passwords. If your Flink password matches any other account, change those too, starting with email, banking and shopping accounts. Your email account matters most, because it can reset everything else.
- Turn on two-factor authentication. Use an authenticator app or a hardware key wherever it is offered. This blocks most account takeovers even when a password leaks.
- Review your payment methods. Check bank and card statements for unfamiliar charges and consider removing saved cards from the app if you no longer use it.
- Use a password manager. It makes unique passwords practical and can flag reused or weak ones.
What This Means For You
The immediate risk is less about the stolen data being used against your Flink account and more about what comes next. Criminals with names and email addresses can send convincing phishing messages, pretend to be Flink support, or claim to be offering refunds or account fixes. Expect delivery-themed texts and emails for the coming weeks.
Be suspicious of any message that creates urgency, asks for payment in crypto, or pushes you to log in through a link. If a message claims to be from Flink, open the app directly or type the address into your browser instead. Real companies do not demand ransom from their customers, and a threat to publish your data unless you pay is a pressure tactic, not a legal process.
Also remember that a small demand does not mean a small risk. The amount is designed to lower your guard.
Key takeaways
For anyone asking about the Flink data breach and what to do, the answer comes down to a few practical actions:
- Do not reply to or pay any extortion demand.
- Check your inbox and a breach-notification service to confirm exposure.
- Change your Flink password and any account that shares it.
- Enable two-factor authentication on email, banking and shopping accounts.
- Treat unexpected delivery, refund or support messages as suspect until verified through official channels.
To understand who is behind these demands, read our background on LPG Group and its ransom demands on Flink customers. Then take ten minutes today to check your exposure, fix your reused passwords and switch on two-factor authentication.
