Vastaamo Breach Exposed Therapy Records and Led to Mass Extortion

Summary

Joe Tidy recounts the Vastaamo breach, in which an attacker exposed psychotherapy records and extorted patients, and the investigation that led to Julius Kivimaki’s conviction.

Key points

• The attacker claimed to have obtained personal details and therapy notes belonging to 33,000 Vastaamo patients and demanded €400,000 from the company.
• After releasing selected patient records, the attacker accidentally uploaded a larger archive containing patient data and information that helped police locate a server.
• The attacker then emailed patients individually, demanding €200 in Bitcoin, rising to €500 after 24 hours. Tidy said about 20 people were known to have paid.
• Detectives identified Julius Kivimaki as a suspect; he was arrested in Paris in 2023 and sentenced to six years and three months in prison in April 2024.
• Vastaamo collapsed into administration. Its former CEO, Ville Tapio, was convicted of data protection violations and was appealing, according to the video.
• The attacker claimed the database was accessible with root credentials; the video does not independently establish that access method.

People