Vastaamo: when hackers stole therapy notes and blackmailed patients

In October 2020, tens of thousands of people in Finland opened an e-mail that knew things about them that almost nobody else did. It carried their full name, their social security number and the fact that they had been in therapy. It said their session notes were in the sender's hands. Pay, or the notes would be published.

This is the story of the Vastaamo psychotherapy breach. If you were a patient, if you have had a similar message, or if you simply worry about what is written in your own records, this page is for you. The aim is to explain plainly what happened, what helped the people affected, and what you can do.

What happened to the patients

Vastaamo was a private company that ran 25 therapy centres across Finland, according to the Guardian, and served roughly 40,000 patients over time, as Malwarebytes reported. Its clients included children.

In late October 2020, patients began to find a message in their inboxes, sometimes in the junk folder. The BBC spoke to Meri-Tuuli Auer, who was one of them. She said the subject line alone told her this was no ordinary spam. The message gave her name and her social security number, the code Finns use for public services and banking, and said the sender had her patient records, including transcripts of her conversations with therapists.

"That's when the fear set in," Auer told the BBC. She took sick leave, shut herself in at home and did not want people to see her. She had told her therapist about her struggles with depression, her drinking and a relationship she had kept secret from her family. She trusted the therapist completely, she said, and had made real progress with his help. She had no idea what had been written down.

Another patient, Tiina Parikka, told the BBC the message caused her to relapse into the mental health problems that therapy had first helped her through. "So many people were affected by this in so many ways," she said.

The scale shocked the country. The BBC called it Finland's biggest-ever crime, and then Prime Minister Sanna Marin convened an emergency meeting of ministers. The Guardian reported that mental health and victim support charities were overwhelmed with calls from distressed people. The interior minister, Maria Ohisalo, called it "a shocking act" and said Finland must be a country where help for mental health issues can be reached without fear.

What was taken, and the order things happened

The theft came first, years before anyone knew. The demands came much later.

When	What happened	Source
2018 and 2019	The patient database was reached by an intruder. Reports differ on whether this was one or two breaches, and the company did not disclose them.	Yle, Malwarebytes, peer-reviewed case study
28 September 2020	The hacker contacts the company's chief executive and demands 40 bitcoin, roughly 400,000 euros.	Peer-reviewed case study (Australasian Psychiatry), BBC
21 to 22 October 2020	Records are leaked in batches of 100 a day, then the whole database is posted. Patients receive individual ransom e-mails and texts.	BBC, peer-reviewed case study
26 October 2020	Authorities launch a victim help website. Ministers hold crisis talks.	Guardian
28 January 2021	Vastaamo is liquidated.	Peer-reviewed case study
2022 to 2023	Police name a suspect in October 2022. He is arrested in France in February 2023.	BBC
30 April 2024	Helsinki district court convicts and sentences him.	BBC, Yle
26 February 2026	The appeals court raises the sentence. The ruling is not final.	Yle

According to the case study published in the journal Australasian Psychiatry, which draws on reporting by Wired, Yle and the BBC, the entire psychotherapy database was posted on the dark web on 22 October 2020. The BBC reported that an unknown number of people read or downloaded copies, and that the notes have been circulating ever since.

The ransom e-mails to patients

What made this case unusual was who got the bill. Hackers who steal from a company usually demand money from the company. Here the company refused, and the hacker turned to its patients.

The BBC reported that the first message to each patient asked for 200 euros in bitcoin within 24 hours. After that the price would rise to 500 euros within 48 hours. The message warned that name, address, phone number, social security number and detailed patient records would be published "for all to see". Malwarebytes described it as a first as far as the researchers knew: demanding money from the breached organisation and from the people whose data it held.

The authorities gave one clear instruction from the first day. The Data Leak Help website, launched on 26 October, told victims not to communicate with the extortionist because the data had most likely already been leaked elsewhere. The BBC later confirmed that is what had happened: the full database was already online before the first patient e-mails were sent. Paying would have bought nothing.

One of the recipients, the former member of parliament Kirsi Piha, posted a screenshot of her message along with a reply. "Up yours! Seeking help is never something to be ashamed of," she wrote, according to the Guardian. Not everyone could answer like that, and no one should feel they had to.

How the breach worked

The weaknesses were basic. The peer-reviewed case study, by Australian psychiatrists, relies on media reports and says it could not access the court record, so treat these details as reported rather than proven.

As reported, Vastaamo ran its own browser-based patient record system on a database server instead of an industry-standard product. The reporting cited by the authors says the records were not anonymised or encrypted in the database or in transit. The only protection was a firewall and a password.

The case study also says Finnish media found passwords that were shared, simple and in some cases absent, and no two-factor login was reported. The chief executive later said he believed administrators had opened remote access to the database server by switching off the firewalls without a protective VPN. The study notes that security reviews in 2017 and 2020 found the company's data protection unsatisfactory. In 2017 the company had self-certified under a lighter class of Finnish rules meant for small organisations, and the authors call that self-regulation "disastrous".

Finland's digital services agency, DVV, said the attack could have been avoided if Vastaamo had used better encryption. Its head, Kimmo Rousku, told Yle that management needed to wake up.

Here is what the researchers say would have made a difference, matching Australian government guidance:

• Multi-factor authentication for remote access and for anyone opening the patient database.
• Strong, unique passphrases, with default and shared passwords removed.
• A gateway firewall, so servers are not directly reachable from the internet.
• Network segmentation, so computers cannot talk to each other unless they need to.
• Encryption of records both in the database and when moving between systems.
• Keeping the most sensitive details, such as full therapy notes, out of the main online record.

The trial and the sentence

Police named a suspect in October 2022: Julius Kivimäki, a known cybercriminal. Finnish court reports and the Yle news service use the first name Aleksanteri for the same man. The BBC said he was arrested in France in February 2023 under a fake identity, after a mistake of his own led investigators to a server he owned. Digital forensics and cryptocurrency tracking also helped the case.

No courtroom could hold the people involved, so the trial was shown in public venues including cinemas. About 21,000 former patients had registered as plaintiffs. Auer attended one of the screenings. She was struck by how ordinary he looked. "It made me feel like it could have been anyone," she told the BBC.

On 30 April 2024 the Helsinki district court found him guilty on all counts and sentenced him to six years and three months. The judges described the blackmail as "ruthlessly taking advantage of another person's special weakness". The BBC and Yle report that the trial was the largest criminal case in Finnish history by number of victims. Yle later listed the convictions: aggravated data breach, almost 9,600 counts of aggravated invasion of privacy, more than 21,300 counts of attempted aggravated extortion and 20 counts of aggravated blackmail.

The company's chief executive, Ville Tapio, was convicted separately of failing to protect customers' sensitive data and received a suspended three-month prison sentence, the BBC reported.

In February 2026 the Helsinki Court of Appeal raised the sentence to six years and 11 months, one month short of the seven-year legal maximum. Yle reported that the court said the crimes caused significant suffering to an exceptionally large number of vulnerable people. The ruling is not final, because both sides can go to the Supreme Court. Kivimäki has denied the charges throughout, according to Yle and the BBC.

Parikka told the BBC the key thing was that he got a prison sentence, though she felt it was short against the number of victims. Auer said that the verdict felt like validation: "The victims' suffering was seen by the court." Both can be true at once.

What it does to people who trusted a therapist

When the place where you said the hardest things out loud turns out to have been open to strangers, the loss is not only privacy, it is the feeling that you could ever safely trust someone with your story again.

Therapy works because you are allowed to say things you have never said to anyone. Here, those notes stopped being private, and the reader could be anyone.

The researchers who studied the case describe harms "ranging from distress to tragic suicides", and say the threat of release caused significant distress and vulnerability for patients with mental illness, as well as for carers and relatives. The BBC reported that the extortionist's victims included people who had described suicide attempts, affairs and abuse in therapy, and children.

It is worth being careful and honest about the most serious harm. A lawyer for the victims, Jenni Raiskio, told the court in March 2024 that her firm had been contacted by people whose relatives had taken their own lives after the records were published, and by others who said they had considered it themselves, according to Yle. The BBC later reported that she knew of at least two such cases. No report can say that one event alone explains a person's death, and families have the right to decide how their loved ones are remembered. What the reports do show is that the fear and exposure were severe enough for lawyers, charities and ministers to treat this as a matter of life and death, and organisations set up direct help lines.

Auer became afraid to take public transport, leave home or even open the door to the postman. Parikka relapsed. Auer told the BBC that some former clients who had been in therapy for years will never book another session. Someone has even built a search engine that lets users look up records on the dark web by name, so for some people the exposure has not ended.

It can pass, or at least change. Auer's account is the one the BBC chose to tell for a reason. She did four things, and none of them was easy:

1. She posted publicly that she was one of the victims, so that the people who knew her already knew. She said that made things easier.
2. She told her family what was in her records, including a relationship she had kept secret. "People were very supportive," she said.
3. She wrote a book about her experience, so that her own account sat beside the clinical one.
4. She accepted that the notes may always exist somewhere, and decided that for her own wellbeing it was better not to dwell on that.

This is one person's path, not a rule. Some prefer to tell no one and lean on a therapist or doctor. Auer's account suggests support helped more than facing it alone.

If you got a message like this: what to do

These steps follow the advice Finnish authorities and Vastaamo gave at the time, as reported by Malwarebytes and the Guardian, plus standard guidance from police fraud services. They apply to any extortion message that claims to hold your private data.

1. Do not pay and do not reply. Paying does not remove the data. In the Vastaamo case the records were already online before most patients got a message.
2. Keep the evidence. Save the e-mail or text with its full header, the sender's address and the time you received it. Take screenshots. Do not forward the message, since it holds personal information.
3. Report it to the police. In the United States, use ic3.gov or tips.fbi.gov. In the United Kingdom, use actionfraud.police.uk. In Finland, file a crime report with the police, and Victim Support Finland (riku.fi) offers guidance in English.
4. Ask the organisation that held your data what was taken. You usually have the right to see your records. In Finland, Auer asked the company for a paper copy of hers.
5. If your identity numbers or accounts might be exposed, protect them. In the United States, use identitytheft.gov to set up a recovery plan. Finland allowed affected people to change their social security numbers.
6. If the message includes intimate images, StopNCII.org can help block them from spreading on major platforms, and takeitdown.ncmec.org helps if the person in an image is under 18.
7. Tell one person you trust. Shame is what extortion relies on. The Finnish former MP who published her message put it plainly: seeking help is never something to be ashamed of.
8. Talk to a professional if you are not sleeping, are afraid to go out, or your mood has dropped. This is a normal response to an abnormal event, not a weakness.

What clinics and therapy practices should do

The Australian researchers wrote their paper for psychiatrists and mental health providers. Their message is that a breach is not an unlikely accident to be handled later. Reviews they cite conclude health record breaches are likely to happen, so what you hold, how you protect it and how you support patients afterwards all need planning.

Area	What the Vastaamo case suggests
Access	Multi-factor authentication for every remote login and for anyone opening the record database. No shared or default passwords.
Storage	Encrypt records at rest and in transit. Keep servers behind a firewall, not open to the internet, and segment the network.
Content	Think about what goes into the online record. Detailed therapy notes may be better kept offline, with a short summary online.
Oversight	Do not rely on self-certification alone. Have independent security reviews, and act on the findings.
Disclosure	Tell patients quickly and clearly if a breach happens. Vastaamo did not disclose earlier incidents, and Malwarebytes reported that its CEO was dismissed over awareness of the breaches.
Support	Have a plan for patients and staff before an incident: help lines, plain language, and a person to call.

Patients can ask their clinic simple questions. How are my notes stored? Who can see them? How would I be told of a breach?

How to protect yourself afterwards

You cannot control how a clinic stores data, but you can limit the damage if something goes wrong.

• Ask your therapist what they record and how it is kept. You can say what you would like left out of written notes.
• Never act on a message that creates panic and a short deadline. Take a breath, and speak to someone before you do anything.
• If a breach happens, use the clinic's official channels only. Be wary of anyone who contacts you offering to remove your data for a fee.

If you need to talk to someone now

If you are in distress or thinking about ending your life, please reach out now. You do not need to be sure that it is serious enough.

• United States: call or text 988, the 988 Suicide & Crisis Lifeline, at any time.
• United Kingdom and Ireland: call Samaritans free on 116 123.
• Anywhere else: call your local emergency number, or go to the nearest emergency department.

If a friend or relative was affected by a breach like this one, you can ask them directly how they are. It tells them someone has noticed.

Frequently asked questions

What was the Vastaamo data breach?

Vastaamo was a private psychotherapy provider in Finland. An intruder took its patient database, which held about 33,000 people's records, then demanded a ransom from the company and later from patients. The full database was posted on the dark web in October 2020. The company was liquidated in January 2021.

Were the therapy notes really leaked?

Yes. The BBC reported that the entire database was published on the dark web before the e-mails to patients were sent, and that an unknown number of people read or downloaded copies. A peer-reviewed case study in Australasian Psychiatry gives 22 October 2020 as the date the whole database was posted.

How much did the hacker demand from patients?

According to the BBC, the first message asked for 200 euros in bitcoin within 24 hours, rising to 500 euros within 48 hours. The company itself was asked for 40 bitcoin, roughly 400,000 euros. Finnish authorities told patients not to pay or reply, because the data had probably already been leaked.

Who was convicted and what was the sentence?

Julius Kivimäki, also named Aleksanteri in Finnish reports, was sentenced in April 2024 to six years and three months. In February 2026 the appeals court raised it to six years and 11 months, according to Yle. The ruling is not final, and he denies the charges. The former Vastaamo chief executive, Ville Tapio, received a suspended three-month sentence.

What should I do if I get a message saying my medical or therapy records were stolen?

Do not pay or reply. Save the message and the sender details, then report it to the police or a fraud service such as ic3.gov or actionfraud.police.uk. Ask the organisation what it holds, protect any exposed ID numbers, and talk to someone you trust.

Can medical records be hacked from a clinic even if I did nothing wrong?

Yes. In the Vastaamo case the weaknesses were in the clinic's own systems, not in anything patients did. Researchers describe poor password practice, no reported two-factor login and unencrypted records. Patients can ask how their notes are stored, but the main responsibility lies with the provider.

Is it safe to see a therapist after a case like this?

Most therapy practices are not run like Vastaamo, and therapy still helps many people. You can ask your therapist how notes are stored and what is written. Some former Vastaamo clients told the BBC they would not return to therapy, so if trust is hard, say so, and take your time.