A 26-year-old Finnish man named Aleksanteri Kivimäki was recently sentenced to six years and three months in prison for hacking patient records at a private psychotherapy center. This case caused outrage in Finland, with a record number of about 24,000 people filing criminal complaints with the police. Kivimäki was found guilty of aggravated data breach, blackmail attempts, and disseminating private information. The Länsi-Uusimaa District Court called his crimes “ruthless” and “very damaging” to the individuals involved.
In 2018, Kivimäki hacked into the information system of the Vastaamo psychotherapy center, which had branches throughout Finland and operated as a sub-contractor for the public health system. He downloaded a database of about 33,000 clients. Prosecutors stated that Kivimäki initially demanded a ransom of around $396,000 in bitcoins from Vastaamo in exchange for not publishing the patient records. When the center refused, he began publishing the information on the dark web and sent messages to patients demanding a ransom of 200 to 500 euros. Approximately 20 patients ended up paying the ransom.
Kivimäki denied all charges during the trial. His lawyer mentioned that he would likely appeal the court’s decision. Prosecutors had sought the maximum sentence of seven years in prison for such crimes under Finnish law. This was not Kivimäki’s first hacking case, as he was first convicted at the age of 15 after hacking into over 50,000 servers that he developed. He also had previous convictions in the United States for hacking cases involving the U.S. Air Force and Sony Online Entertainment.
After being arrested in France in February 2023, Kivimäki was deported back to Finland to face trial. The court found him guilty of nearly 21,000 aggravated blackmail attempts and more than 9,200 aggravated disseminations of private information. The severity of the crimes was highlighted by the court, given the impact on the individuals involved. The psychotherapy center, Vastaamo, declared bankruptcy in 2021 following the data breach.
The case has generated significant attention in Finland, as it highlights the vulnerability of sensitive information and the potential consequences of cybercrimes. The record number of criminal complaints filed in response to this breach underscores the public outrage and concern over the protection of personal data. As technology continues to advance, the need for stronger cybersecurity measures and penalties for cybercriminals becomes increasingly important to safeguard sensitive information and prevent similar incidents from occurring in the future.
