Finnish psychotherapy extortion suspect arrested in France

In October 2022, we asked you to imagine being stuck in the following awful situation:

Imagine that you’d spoken in what you thought was total confidence to a psychotherapist, but the contents of your sessions had been saved for posterity, along with precise personal identification details such as your unique national ID number, and perhaps including additional information such as notes about your relationship with your family…

…and then, as if that were not bad enough, imagine that the words you’d never expected to be typed in and saved at all, let alone indefinitely, had been made accessible over the internet, allegedly “protected” by little more than a default password giving anyone access to everything.

Sadly, for tens of thousands of trusting patients of the now-bankrupt Psychotherapy Centre Vastaamo, that really happened.

It gets worse

Worse, a cybercriminal found his way into the poorly-secured system and stole all that ultra-personal data.

Worse still, the company responsible for keeping that data secure decided to keep quiet about the intrusion, with the company CEO apparently deciding that he could get away with hiding the breach from the authorities as long as no publicly visible harm came of it.

But the breach couldn’t be denied any more once the company was hit up with a blackmail demand for €450,000 (about $0.5m at the time).

Ultimately, as reported in the Helsinki Times in late 2022 in an article entitled Prosecutors: Vastaamo’s information security was in absolute chaos, the now-former CEO was charged personally with data protection offences, even though the company itself was the victim of a cybercrime.

Worst of all was that when the company itself refused to pay the blackmail money (which, as we pointed out last year, wouldn’t have done much good given that the data had already been stolen), the extortionist turned their attention directly on the company’s patients.

Patients were blackmailed to the tune of €200 each, with cybersecurity journo-sleuth Brian Krebs reporting in 2022 that the demand jumped to €500 if the initial “fee” wasn’t paid within 24 hours, followed by publication of personal details 48 hours after that.

The hacker threatened to release not only the sort of information that would help other crooks to carry out identity theft, including contact details and ID data, but also the saved transcripts of patients’ conversations that we mentioned at the top of this article.

The Finnish authorities issued an arrest warrant for the suspected hacker in October 2022, noting that:

The police have established that the suspect currently resides abroad. For this reason, he was remanded in absentia. A European arrest warrant has been issued against the suspect. He can be arrested abroad under this warrant. After that the police will request his surrender to Finland. An Interpol notice will also be issued against the suspect, who is a Finnish citizen and about 25 years of age.

He appeared on Europol’s Most Wanted Fugitives list on 2022-11-03, charged with eight offences: aggravated computer break-in, attempted aggravated extortion, aggravated dissemination of information violating personal privacy, extortion, attempted extortion, computer break-in, message interception, and falsification of evidence:

Suspect apprehended

Well, the Finns have just announced that the suspect has been apprehended in France, where he has been locked up while his extradition to Finland is being processed.

Brian Krebs, who is well-known for digging into the histories of notorious hackers and hacking suspects, has published a report listing a string of previous cybercrimes for which Kivimäki has been convicted, apparently including denial-of-service attacks under the banner of Lizard Squad, theft of source code from Adobe, use of stolen credit cards, and more.

According to Krebs, the suspect was convicted of “orchestrating more than 50,000 cybercrimes”, but got away with a suspended sentence and a small fine, having been under 18 at the time of that criminal activity.

After he’d evaded a prison sentence, says Krebs, the Lizard Squad hacking group openly boasted on Twitter than “All the people that said we would rot in prison don’t want to comprehend what we’ve been saying since the beginning, we have free passes.”

If his extradition from France is approved in this case, and he’s convicted, we can’t imagine the consequences being quite so much of a “free pass” this time, now he’s 25 years old.

What to do?

• Rehearse what you will do if you suffer a breach yourself. You are not preparing to fail if you do so, but you are failing to prepare if you don’t. Learn what your reporting obligations are, and practise what you would say to those affected by the breach. As this case suggests, prompt disclosure would at least have prevented tens of thousands of vulnerable people finding out about the breach from extortion demands made directly to them and their families.
• Consider filing a personal report if you are caught up in a breach. This helps regulators and law enforcement collect evidence; helps to determine an appropriate level of response (if no one says anything, then it’s hard to convince a court that real harm was done); and helps the authorities demand higher cybersecurity standards in future.