Vastaamo was a Finnish private psychotherapy service provider founded in 2008. On 21 October 2020, Vastaamo announced that its patient database had been hacked. Private information obtained by the perpetrators was used in an attempt to extort Vastaamo and, later, its clients. The extorters demanded 40 bitcoins, roughly 450,000 euros, and threatened to publish the records if the ransom was not paid. To add pressure to their demands, the extorters published hundreds of patient records a day on a Tor message board.
After extortion of the company failed, the extorters sent emails to the clients whose data they had obtained, demanding that they pay ransoms in order to avoid publication of their sensitive personal data. These ransom demands were sent to roughly 30,000 victims. The company's security practices were found to be inadequate: the sensitive data was not encrypted and anonymized and the system root did not have a defined password. The patient records were first accessed by intruders in November 2018, while the security flaws continued to exist until March 2019.
In December 2021, the Finnish Data Protection Authority (DPA) fined Vastaamo 608,000 euros for violating the provisions of the General Data Protection Regulation (GDPR). This cyber-attack became the biggest criminal case in Finland history. It also turned into an international scandal and a cyber-attack unprecedented in its scope due to the tactic called double extortion applied by the cyber criminals.
On October 28, 2022, the National Bureau of Investigation named the suspect behind the breach as 25-year-old Aleksanteri Julius Kivimäki. Kivimäki was charged in absentia at Helsinki District Court for aggravated data breach, aggravated attempted extortion, aggravated distribution of information infringing private life, blackmail, breach of confidentiality and falsification of evidence. A warrant was filed with Europol and Interpol against Kivimäki, who has said he was in Dubai. In 2015, Kivimäki, then a member of Lizard Squad, was found guilty on over 50,000 counts of computer crime.
Julius Kivimäki, a suspect in the Vastaamo data breach, was arrested in France on 3 February 2023. He was extradited to Finland on 24 February.
Background
Vastaamo was a Helsinki-based private psychotherapy center founded in 2008 that provided private mental-health services to its patients. It was a firm with twenty-five therapy centers throughout the Nordic country of 5.5 million people. Vastaamo operated as a sub-contractor for Finland's public health system. Ville Tapio, ex-CEO of Vastaamo first heard from the hacker on 28 September 2020. He immediately notified various government authorities, including the police. On 21 October 2020, Vastaamo announced that its confidential treatment records of approximately 36,000 psychotherapy patients and 400 employees had been compromised. The psychotherapy center received a ransom demand for 450,000 euros in Bitcoin. The leaked patient database contained psychotherapy clients’ personal information, such as their full names, home addresses, email addresses, social security numbers, names of the clinics where they received treatments, and therapists’ and doctors’ notes from each session.
As the company resisted to pay the ransom, the hacker, using the alias “ransom_man,” published the therapist session notes of at least 300 patients, including politicians and police officers, using a server called Tor, a public forum. The therapist session notes contained information about adulterous relationships, suicide attempts and pedophilic thoughts. The hacker approached victims of the security breach directly with extortion emails demanding ransoms of 200 euros paid in Bitcoin, with the amount increased to 500 euros unless paid within 24 hours. A 10-gigabyte data file containing private notes between at least 2,000 patients and their therapists had appeared on websites on the “dark web.” Patient information was stolen during two attacks, which started as early as 2018. This first intrusion on Vastaamo's database took place in November 2018, and the systems were penetrated between the end of November 2018 and March 2019. PTK Midco, a holding company owned by Intera Partners, a Finnish private equity firm, which acquired a 70% stake in Vastaamo in May 2019. The company has asked for inquiry into acquisition and also requested that its acquisition of the company be cancelled and the purchase price be returned for failure to disclose hacking.