Hackers demand ransom from therapy patients after clinic data breach
Vastaamo CEO Ville Tapio was reportedly fired for obscuring information about the incident for more than two years
A hacker is trying to blackmail thousands of Finish patients after gaining access to their personal information via a psychotherapy company.
Police have said that an unknown party started demanding ransom from more than 40,000 patients whose data was stolen from the Vastaamo psychotherapy centre, according to local media reports.
The data was taken during a cyber attack in November 2018, and potentially again in March 2019, the Helskinki-based centre said in a statement.
The company is cooperating with the police, but it's reported that some 300 records have already been published on the dark web. It is also being reported that the firm's CEO, Ville Tapio, has been fired for obscuring information about the data breach for more than two years.
The hackers originally sought to extort a ransom from the centre's management but changed tactics over the weekend to elicit payments from individuals that had used the service.
Various patients have spoken to media outlets to say that the hackers have contacted them and threatened to leak mental health records onto the internet unless they provide payment in Bitcoin. Some of the people whose data has been stolen are also underage.
One patient told the BBC that the hacker said Vastaamo had refused to pay 40 Bitcoin (£403,000) and he would now have to pay €200 worth in order to stop his information being released - this included session notes from when he was a teenager.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
"I'm anxious about the fact that the attackers are in possession of my notes and conversations from those psychiatrist sessions," he said. "Those notes contain things I'm not ready to share with the world. And having someone threaten me with said notes certainly makes me extremely uncomfortable."
The patient's notes had been taken in a physical notebook and he/she wasn't told these would be uploaded to a server. The country's prime minister Sanna Marin tweeted that the Finish government was looking into ways to support the victims of what he called a "shocking" hack.
Bobby Hellard is ITPro's Reviews Editor and has worked on CloudPro and ChannelPro since 2018. In his time at ITPro, Bobby has covered stories for all the major technology companies, such as Apple, Microsoft, Amazon and Facebook, and regularly attends industry-leading events such as AWS Re:Invent and Google Cloud Next.
Bobby mainly covers hardware reviews, but you will also recognize him as the face of many of our video reviews of laptops and smartphones.
-
Researchers warn thousands of active AWS access keys are publicly exposedNews In hundreds of cases, the keys could give attackers complete administrative control
-
Iranian cyber attack on UK power plant ‘should concern every organization responsible for keeping this country running’News The attack is believed to be the first of its kind in the UK
-
Companies are still paying ransoms to cyber criminals despite official adviceNews A Proofpoint survey found evolving ransomware techniques and the use of AI is exacerbating the situation for victims
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals