159: Vastaamo

What It Covers

The 2020 Vastaamo psychotherapy center breach exposed 33,000 Finnish patients' therapy notes. Hacker Julius Kivimäki extorted victims individually for Bitcoin, demanding €200-500 per person, ultimately receiving only €6,000 total before arrest.

Key Questions Answered

• •Individual victim extortion: After failing to extort the company for €400,000, the attacker sent 27,500 personalized ransom emails directly to patients, demanding €200 within 24 hours or €500 after, threatening to publish their therapy notes online—a previously unseen tactic at this scale.
• •Operational security failures: The hacker accidentally uploaded his entire home directory including an IP address to a Helsinki cloud provider while posting stolen data, allowing police to physically seize the server within hours and recover critical evidence linking to previous cybercrimes.
• •Therapeutic data vulnerability: Therapy notes contained patients' deepest secrets including affairs, workplace conflicts, and trauma details. The breach caused multiple suicides among victims who faced exposure of this information, demonstrating therapy records represent the most damaging personal data type for extortion.
• •Criminal justice scale: Kivimäki faced 9,231 counts of privacy invasion (actual complainants), 21,000 attempted extortion charges (emails sent), and 20 aggravated blackmail counts (payments received), creating Finland's largest criminal case and prompting justice system reforms for mass victim scenarios.