The ten-euro mail

The company refused the first demand. The second one arrived in the customer’s own inbox.

Flink told heise it does not talk to criminals and did not answer the approach that asked the company for ether. The mail that followed, which heise sampled, comes from a group calling itself LPG and asks each person for 0.005 ETH, about €10, toward a pooled 100 ETH, with a threat to sell the file if the pool is not filled. The date on that clock is 2 October. Flink told heise that at least 10,000 of those messages landed in the Netherlands. NOS and NL Times carried the same shape: do not answer, do not pay. What Flink has described as copied is names, postal addresses, emails, phone numbers, and in some accounts the order history and the note left for the courier. Passwords, bank details, and card numbers are the fields the company says were not in it.

A million customers and 13,000 staff is the number in the criminals’ mail. Flink has not adopted it. NOS notes the company has about 1.5 million customers in the Netherlands, so the claim is large enough to be a majority and still unverified.

What the €10 is for

It is not a restoration fee. The till was not the story Flink told. The €10 buys a feeling that your row will be deleted from a pile you cannot see, after the company already refused a deletion promise aimed at the whole pile. Paying confirms the address is live. Forwarding the mail to the company, which the message invites, is how they get a second channel for free.

Counsel will want the company’s “we don’t negotiate” line read as the end of the incident. It was the start of the customer campaign. The object to hold is the message, with the date, and the field list the company actually confirmed. The object to ignore is the wallet instruction.

I still do not treat a pooled ransom as a refund. I treat a mail that already knows the doorbell note as the incident.