Metraipolis › archive › dc_a9aaffe65951

Vastaamo data breach — Wikipedia (en)

Source: Wikipedia (en)
Original: https://en.wikipedia.org/wiki/Vastaamo_data_breach
License (as archived): CC-BY-SA-4.0
Archived: 2026-10-05T23:15:40.020Z
SHA-256 of the archived text: cc861d8feb384de77bea0d96ff115972506242d51af0093be765496e25c44fd0
Stable URL of this page: https://metraipolis.com/documento/dc_a9aaffe65951

How to cite

Vastaamo data breach — Wikipedia (en) — Wikipedia (en), https://en.wikipedia.org/wiki/Vastaamo_data_breach (CC-BY-SA-4.0); archived copy: https://metraipolis.com/documento/dc_a9aaffe65951 (Metraipolis archive dc_a9aaffe65951, sha256 cc861d8feb384de77bea0d96ff115972506242d51af0093be765496e25c44fd0)

BibTeX

@misc{dca9aaffe65951,
  title = {Vastaamo data breach — Wikipedia (en)},
  howpublished = {Wikipedia (en)},
  url = {https://en.wikipedia.org/wiki/Vastaamo_data_breach},
  note = {License CC-BY-SA-4.0; archived copy https://metraipolis.com/documento/dc_a9aaffe65951; sha256 cc861d8feb384de77bea0d96ff115972506242d51af0093be765496e25c44fd0},
  year = {2026}
}

Archived text

Reproduced under CC-BY-SA-4.0. Attribution: Wikipedia (en), https://en.wikipedia.org/wiki/Vastaamo_data_breach. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Vastaamo was a Finnish private psychotherapy service provider founded in 2008. On 21 October 2020, Vastaamo announced that its patient database had been hacked. Private information obtained by the perpetrators was used in an attempt to extort Vastaamo and, later, its clients. The extorters demanded 40 bitcoins, roughly worth 450,000 euros at the time, and threatened to publish the records if the ransom was not paid. To add pressure to their demands, the extorters published hundreds of patient records a day on a Tor message board. After extortion of the company failed, the extorters sent emails to the clients whose data they had obtained, demanding that they pay ransoms in order to avoid publication of their sensitive personal data. These ransom demands were sent to roughly 30,000 victims. The company's security practices were found to be inadequate: the sensitive data was not encrypted and anonymized and the system root did not have a defined password. The patient records were first accessed by intruders in November 2018, while the security flaws continued to exist until March 2019. In December 2021, the Finnish Data Protection Authority (DPA) fined Vastaamo 608,000 euros for violating the provisions of the General Data Protection Regulation (GDPR). This cyber-attack became the biggest criminal case in the history of Finland. It also turned into an international scandal and a cyber-attack unprecedented in its scope due to the tactic called double extortion applied by the cyber criminals. On October 28, 2022, the National Bureau of Investigation named the suspect behind the breach as 25-year-old Aleksanteri Kivimäki. Kivimäki was charged in absentia at Helsinki District Court for aggravated data breach, aggravated attempted extortion, aggravated distribution of information infringing private life, blackmail, breach of confidentiality and falsification of evidence. An arrest warrant was filed with Europol and Interpol against Kivimäki stating that he was in Dubai. In 2015, Kivimäki, then a member of Lizard Squad, was found guilty on over 50,000 counts of computer crime. Kivimäki was arrested in France on 3 February 2023. He was extradited to Finland on 24 February. In April 2024, he was convicted and sentenced to six years and three months in prison by the Western Uusimaa District Court. In September 2025, the Helsinki Court of Appeal released Kivimäki from prison despite upholding his conviction. In September 2025, Finnish prosecutors charged a 28-year-old American living in Estonia with aiding and abetting the extortion of therapy patients.

Tema degli esploratori: diritto e tecnologia (deposito sistematico; ricerca «General Data Protection Regulation»).
Fonte: Wikipedia in inglese, voce «Vastaamo data breach» — https://en.wikipedia.org/wiki/Vastaamo_data_breach
Wikidata Q100887434 (dati Wikidata in CC0 1.0) — https://www.wikidata.org/wiki/Q100887434
Autori: i contributori di Wikipedia (cronologia: https://en.wikipedia.org/wiki/Vastaamo_data_breach?action=history).
Licenza: Creative Commons Attribuzione-Condividi allo stesso modo 4.0 (CC BY-SA 4.0) — https://creativecommons.org/licenses/by-sa/4.0/. Il riuso richiede attribuzione e stessa licenza.
Estratto dell'introduzione non modificato nel contenuto; revisione 1377683990, consultata il 2026-10-05T23:03:37.822Z tramite l'API ufficiale di Wikipedia. Impronta SHA-256 dell'estratto: d9283e1bde38d027080190a505da52101687e1b7a4a5321bc4c55342091e6459