Flink data breach: an ex-employee login was enough (05/10/2026)
A former employee's login was enough to get into Flink on 25 September 2026. The criminals first asked each affected person for about 10 euros, then 235,000 euros from the company; nobody paid, so the file went up for sale on 5 October. Three lessons any SME in the Netherlands, Belgium, France or Luxembourg can copy.
In short
On 25 September 2026, Dutch grocery delivery service Flink found intruders in its systems: according to the company itself, the attackers signed in with the compromised credentials of a former employee[1]. The criminals then demanded 0.005 ETH, roughly 10 euros, from each affected individual, and 100 ETH, roughly 235,000 euros, from Flink to destroy the set[2]. Nobody paid, so on 5 October 2026 the data was offered for sale to the highest bidder[3].
If you run an SME in the Netherlands, Belgium, France or Luxembourg, remember the sequence rather than the company name. This data breach starts with a forgotten account and ends with a customer list on sale, by way of two duties many companies still merge into one.
What happened, in three steps
Step one, the way in. Flink attributes the breach to the compromised credentials of a former staff member; the account was blocked as soon as it was discovered[1][2]. Step two, the extortion. Instead of targeting only the company, the group wrote directly to the individuals: about 10 euros in Ethereum to keep their data off the dark web, and 235,000 euros asked of Flink to delete everything[2]. Step three, the resale. The ultimatum expired without a single payment, and the attackers then put the set up for sale[3].
Be careful with the volume figure: the attackers claim data on one million customers and 13,000 employees, a number Flink has not confirmed[2]. The company was precise about the data categories, though: names, email addresses, postcodes and phone numbers, and for part of the orders, delivery details — floor, entrance, name on the doorbell, instructions left for the courier. No passwords and no payment data[2].
That last detail deserves a moment's thought. "No bank details" is reassuring financially, but a file that says where you live, on which floor and which name to read on the doorbell is not a harmless file.
The way in: an account that should have been closed
This is the part that transfers to any SME without effort. Someone leaves, the contract ends, the badge comes back — and their access to the CRM, the shared mailbox, the VPN or the logistics tool stays live, because nobody holds the full list of what must be cut. We described the same mechanism, stolen credentials and no second factor, in our analysis of the ANSSI report on the DGFiP attack: the intrusion needs no technical exploit, only an account left alive.
The fix is not a project, it is a list. Write it once and it serves every departure.
| Cut on the day someone leaves | Who does it |
|---|---|
| Main account: directory, Microsoft 365 or Google Workspace, open sessions | IT |
| Remote access: VPN, remote desktop, administration tools | IT |
| Business apps outside the directory: CRM, invoicing, logistics, supplier tools | Tool owner |
| Shared accounts whose password the person knew | Tool owner |
| API keys, tokens and technical access the person created | IT |
| Mailbox: forward to a colleague, then close | Management |
Two safeguards complete the list. First, a second factor on every remote access: it does not protect you from a forgotten account, but it makes a password harvested elsewhere useless. Second, a quarterly review of active accounts against the list of people actually employed — that is the only control that catches what was missed. Our cybersecurity for SMEs page sets out the method.
Data breach notification: two separate duties, the authority and the people
The GDPR clearly separates two obligations, and this is where companies get it wrong. Article 33 requires notifying the supervisory authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk. Article 34 requires, in addition, informing the affected individuals themselves without undue delay when the breach is likely to result in a high risk to their rights and freedoms[8]. The first duty is administrative; the second is the one your customers notice.
In the Flink case, several people whose data was circulating told the Dutch press they had received no individual notice from the company[3]. The Autoriteit Persoonsgegevens, for its part, advised people to assume their data had leaked and to act accordingly[2] — advice an authority only gives when the information did not come from the company.
Who to notify, by country:
| Country | Authority to notify |
|---|---|
| Netherlands | Autoriteit Persoonsgegevens (AP)[4] |
| Belgium | Data Protection Authority (APD / GBA)[6] |
| France | CNIL[5] |
| Luxembourg | Commission nationale pour la protection des données (CNPD)[7] |
Do not confuse this route with the NIS2 one, which has its own deadlines and its own authority when your company falls in scope: in the Netherlands, for instance, those duties sit under the Cyberbeveiligingswet and the competent regulator, not the AP. We set out the Dutch scope on our NIS2 in the Netherlands page. One incident can therefore trigger two separate filings.
For the practical detail of a notification — what to write, and the trap of a deadline that starts running the moment you "become aware" — see our articles on the Jims breach and notification duties and on the 72-hour deadline when the breach happens at a supplier.
"Nobody paid" does not close the incident
The collective refusal to pay is good news, and Flink held the line: no contact, no negotiation, file a police report[2]. But what follows has to be said plainly: that refusal did not destroy the data, it only changed the buyer. A few days later, the set was on sale[3].
The operational consequence for you: after a breach the risk does not fade, it moves. Resold lists feed targeted phishing — a fake message quoting your last order, its amount and your address is far more convincing than a generic email. So warn your customers about what is coming, not only about what happened: nobody from your company will ask them to pay anything in cryptocurrency, and paying a blackmailer is never an option.
Warn your own team too. The 13,000 employees claimed in this set are a reminder that an exposed HR file hits your own staff, who will receive the same messages.
To do this week
- Export the list of active accounts from your directory and compare it with the list of people currently employed. Any account with nobody behind it gets closed today.
- Do the same round on tools outside the directory: CRM, invoicing, logistics, shared mailboxes, access opened for a supplier.
- Write the leaver checklist, with an owner on each line, and file it with your end-of-contract paperwork.
- Switch on a second factor for every remote access and every administrator account.
- Make sure you know, without looking it up, which authority to notify and within what deadline: AP, APD, CNIL or CNPD depending on your country.
- Draft the message to affected individuals now, while nothing is burning. On the day of the incident you will not have time to write it.
Chez CyberNovaLabs.io
CyberNovaLabs.io works with SMEs in the Netherlands, Belgium, France and Luxembourg on exactly these two points: closing access cleanly when someone leaves, and knowing what to report, to whom and within what deadline. We start from your actual tools rather than a generic template, and we leave you the leaver checklist and the draft notification. This is a best-efforts engagement, not a guaranteed outcome. Let's go through your situation in twenty minutes.
Sources
- Security.NL — Klanten en personeel Flink afgeperst door criminelen na hack supermarkt (25/09/2026)
- ICT Magazine — Klanten supermarkt Flink afgeperst na hack via oud-medewerker (28/09/2026)
- NL Times — Hackers offer 1 million stolen Flink records to the highest bidder after extortion fails (05/10/2026)
- Autoriteit Persoonsgegevens — Datalekken (autorité néerlandaise, consulté le 12/10/2026)
- CNIL — Notifier une violation de données personnelles (autorité française, consulté le 12/10/2026)
- Autorité de protection des données (APD/GBA) — espace professionnel (autorité belge, consulté le 12/10/2026)
- Commission nationale pour la protection des données (CNPD), Luxembourg (consulté le 12/10/2026)
- RGPD — règlement (UE) 2016/679, articles 33 et 34 (texte officiel, EUR-Lex)
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Critical PHP flaws: your website is affected (21/10/2026)
Two critical vulnerabilities in PHP, the engine under most small-business websites, allow unauthenticated remote code execution. Patches shipped on 21 October 2026. What to check this week, and what will never be fixed.
Read the article →October 22, 2026 · 9 min readNIS2 Netherlands: are software vendors and IT providers in scope?
Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.
Read the article →October 13, 2026 · 8 min readOutsourcing B2B appointment setting: 10 clauses to check
An appointment setting contract is decided on ten clauses, not on a day rate. France has banned consumer cold calling without prior consent since 11 August 2026 and Bloctel no longer exists; the EU AI Act transparency duties have applied since 2 August 2026. Here are the ten clauses, and the calling regime of all four countries.
Read the article →October 13, 2026 · 7 min readB2B appointment setting for manufacturing and industry
In manufacturing, a meeting is not won by a better script. It is won by reaching the right role in the decision chain, hitting the right window in the plant calendar, and having your supplier qualification file ready before the first call.
Read the article →October 12, 2026 · 7 min readNIS2 Netherlands: healthcare and labs under the Cbw
In the Netherlands, the question "are we in scope?" is settled faster than in most sectors: a care provider with 50 FTE is in, and there is no transition period. Here are the exact thresholds, the regulator, the sector CSIRT, and the five actions to take this week.
Read the article →October 11, 2026 · 7 min readNIS2 France: are transport and logistics firms in scope?
A road haulier is not in NIS2 scope because it moves freight. But two regimes already bind French operators today, and a third arrives through their customers. The texts, the dates and the figures, with no invented fines.
Read the article →