Vastaamo psychotherapy data breach and patient extortion (Finland, 2020)

The Vastaamo breach is the largest criminal case in Finland's history and the most severe example yet of mass extortion of individual patients following a healthcare data breach. Records on approximately 33,000 patients — including notes from therapy sessions — were stolen in 2018 from a database with no encryption and a root account that had no password. After company-extortion failed in October 2020, the attacker emailed ransom demands directly to the patients.

What happened

Vastaamo was a private psychotherapy provider operating clinics across Finland. In November 2018, an attacker accessed the patient database. The data was unencrypted, the system root account had no password. The records included extensive therapy notes — the kind of intimate, identifying detail that mental-health treatment requires.

The breach went undetected for two years. In September 2020, the attacker contacted Vastaamo demanding 40 BTC (~€450,000) and threatening publication. Vastaamo did not pay. On 21 October 2020, the company publicly disclosed the breach.

The attacker then escalated unusually. Rather than dump the data, they emailed ransom demands directly to the patients themselves — approximately 30,000 individual extortion attempts — threatening to publish each person's therapy notes. This was an order-of-magnitude escalation of healthcare-data extortion tactics and caused widespread distress across Finland.

Vastaamo filed for bankruptcy in February 2021. The Finnish Data Protection Authority fined the company €608,000 for GDPR violations in December 2021. In October 2022, Finland's National Bureau of Investigation named Aleksanteri Kivimäki, 25, as the suspect. In April 2024, he was convicted on the aggravated data breach charge plus over 21,000 counts of extortion and sentenced to 6 years 3 months in prison.

The case against former CEO Ville Tapio for the underlying GDPR-related negligence ended differently: a 3-month suspended sentence at first instance, then a unanimous acquittal on appeal in December 2025.

Impact

• ~33,000 patients had therapy notes and identifying data stolen.
• ~30,000 individual extortion emails sent to patients directly.
• Vastaamo bankrupt; €608,000 GDPR fine.
• Aleksanteri Kivimäki convicted (21,000+ counts) and sentenced to 6 years 3 months.
• Former CEO acquitted on appeal.

Why it matters

Vastaamo is the case that changed how regulators and clinicians think about mental-health data protection. The attacker's choice to extort individual patients — by threatening to expose what they had told their therapist — was a deliberate escalation of healthcare data extortion tactics. The criminal case against the former CEO, even after acquittal, has been studied across Europe as a stress test for GDPR's individual-criminal-liability provisions.