Records she had never intended to show anyone had fallen into someone else's hands.
Cybercrime: Malice in Everyday Life — Part 5
You don't have to be someone special to be targeted.
Everyday life has unseen points of entry. Drawing on publicly available information, we trace how these threats unfold quietly and how their consequences eventually surface in everyday life.
From a place she had almost forgotten
The email arrived on a Saturday night.
She did not recognize the sender. Assuming it was spam, she was about to delete it.
But the subject line contained her name.
As she read on, she came across the name of a psychotherapy center she had visited in the past.
She had gone there several years earlier, when she was struggling with issues involving work and family.
The email also contained personal information about her.
How could a stranger know these things?
The sender claimed to have stolen the center's patient records.
The message demanded that she pay a sum of money by a specified deadline. Otherwise, it threatened, her consultation records would be published online.
At first, she thought it was just a malicious threat.
But the message was not like indiscriminate spam that could have been sent to anyone.
The sender knew that she had actually visited the center.
Perhaps the sender even knew what she had talked about there.
Closing the email did not make it any easier to sleep.
It was not a secret kept by one person alone
The center she had visited was Vastaamo, a psychotherapy provider in Finland.
In October 2020, it became public that the center's patient database had been accessed without authorization and that a large amount of personal information had been exposed. Subsequent technical investigations confirmed that the database had been accessed without authorization at least twice, in December 2018 and March 2019.
The stolen information was not limited to names and contact details.
It also included highly sensitive information, such as patients' therapy notes.
The center received a demand for money accompanied by a threat to publish patient information.
Patients also began receiving direct emails threatening to publish their personal information and consultation records unless they paid.
The targets of the threats were not only the organization itself.
They were the ordinary people who had sought help there.
Patient information was in fact published on the internet.
Things they had never told anyone. Things they had never expected their families, friends, or colleagues to learn.
That information had been taken, against their will, and placed where strangers could see it.
For those whose information had been stolen, this was not simply a data breach.
It was as if a part of their lives had been opened up and exposed to others without their permission.
Even though she had done nothing wrong
She had not deceived anyone or been involved in any crime.
She had simply sought professional help when she was going through a difficult time.
And yet, what she had shared in those sessions was being used as leverage for extortion.
Even if the information were true, that would not give anyone the right to make it public.
People need places where they can seek help without others finding out.
Having things one does not want others to know does not necessarily mean having something to be ashamed of.
Family relationships, worries about work, uncertainty about oneself.
People can ask for help because there are places where they can talk about such things in confidence.
That trust had been broken.
Some people may not even have wanted others to know they had visited the center. Others may have feared that those around them would see them differently if the contents of their records became known.
What happened here was more than the theft of information.
The very fear of having deeply personal things revealed to others had been turned into a means of making money.
Who bears responsibility?
The Finnish police conducted a large-scale investigation into the incident.
In June 2021, the Finnish Police announced that they had received more than 25,000 reports of crimes related to the extortion of victims of the incident. The police believed the actual number of victims was even higher.
These 25,000 reports did not represent the exact number of victims. They were reports filed with the police. Even so, they show that the harm extended far beyond a small, limited group of people.
Nor was the attacker the only party at issue.
Finland's data protection authority found serious deficiencies in the way Vastaamo had protected patient information and in its obligations to report the data breach.
In December 2021, the center was fined 608,000 euros.
Criminal proceedings against the perpetrator also went ahead.
In April 2024, the District Court sentenced the defendant to six years and three months in prison. In February 2026, the Court of Appeal increased the sentence to six years and eleven months. In July of the same year, the Supreme Court of Finland refused leave to appeal, making the Court of Appeal's judgment final.
But the privacy of those affected was not restored.
Who had saved the information that was published? Who had read it? How far had it spread?
There was no way to know everything.
The assumption that "it isn't very important information"
When we hear that our personal information has been exposed, we sometimes tend to downplay the consequences.
A name and email address alone are no big deal.
If someone learns our phone number, we can simply change it.
We do not have the kind of important confidential information that large corporations protect.
But the value of information is not determined by each piece on its own.
For example, a name and address alone may not seem like a serious problem.
But when they are combined with information about the services someone uses, their purchase history, consultation records, daily activities, and personal relationships, a picture of that person's life begins to emerge.
And it is not the owner of the information, but whoever obtains it, who decides how to use it.
Name, address, contact details
|
+
Service usage history
|
+
Consultation and inquiry details
|
v
A person's life and background
become visible
|
v
Impersonation, extortion, threats
Interference in relationships, misuse
Each piece of information may seem insignificant on its own. Combined, however, it can take on serious meaning for the person concerned.
The same is true for small businesses.
Customer addresses, purchase histories, inquiry details, and correspondence with business partners.
These are not merely business records. They are also part of someone's life.
The drawer that was supposed to be closed
Following the incident, the Finnish police urged people who had received extortion emails not to pay, to report the matter to the police, and to preserve evidence such as the emails.
But taking those steps could not fully retrieve information that had already been exposed.
Every day, we entrust our information to a wide range of services.
We shop. We visit hospitals. We use counseling services. We hire people to do work for us.
Each time, we share not only our names and contact details, but also many details about our circumstances.
It is difficult for users to verify at all times whether that information is being properly protected.
That is why those who hold other people's information have a responsibility to manage it securely.
"I don't have any information worth stealing."
Was there really nothing inside the drawer you thought held nothing worth taking?
And will the person entrusted with the key to that drawer take responsibility for keeping it safe to the very end?
References
Finnish Police, National Bureau of Investigation, “NBI to continue criminal investigation into exceptionally large-scale hacking of psychotherapy customer files” (announced October 27, 2020; English version published November 24, 2020).
https://poliisi.fi/en/-/nbi-to-continue-criminal-investigation-into-exceptionally-large-scale-hacking-of-psychotherapy-customer-filesFinnish Police, “Victims of Vastaamo hacking incident: In order to become a party in the criminal proceedings, report the crime” (June 23, 2021).
https://poliisi.fi/en/-/victims-of-vastaamo-hacking-incident-in-order-to-become-a-party-in-the-criminal-proceedings-report-the-crimeFinnish Government, Office of the Data Protection Ombudsman, “Administrative fine imposed on psychotherapy centre Vastaamo for data protection violations” (announced December 16, 2021; English version published December 27, 2021).
https://valtioneuvosto.fi/en/-/6927448/administrative-fine-imposed-on-psychotherapy-centre-vastaamo-for-data-protection-violationsSupreme Court of Finland (Korkein oikeus), “Korkein oikeus hylkäsi valituslupahakemuksen Vastaamon tietomurtoa ja sitä seuranneita kiristysrikoksia koskeneessa asiassa” (July 13, 2026; Finnish-language announcement).
https://www.korkeinoikeus.fi/ajankohtaista/tiedote-ja-uutisarkisto/korkein-oikeus-hylkasi-valituslupahakemuksen-vastaamon-tietomurtoa-ja-sita-seuranneita-kiristysrikoksia-koskeneessa-asiassa/Finnish Government, “Advice for the victims of the data leak” (announced October 25, 2020; English version published October 26, 2020).
https://valtioneuvosto.fi/en/-/6927448/advice-for-the-victims-of-the-data-leak
The opening scenes depicting an individual's experience are not a reconstruction of the testimony of any one actual victim. This fictionalized account combines multiple pieces of publicly available information about the Vastaamo data breach, extortion attempts directed at patients, the publication of information, the authorities' response, and the criminal proceedings. The character, email wording, chronology, and other details are fictionalized. The Finnish Police stated that it was not known whether the person who attempted to extort the center was the same person who sent extortion emails to individual patients.
The institutions and authorities cited above—the Finnish Police and its National Bureau of Investigation, the Office of the Data Protection Ombudsman, the Supreme Court of Finland, and the Finnish Government—are Finnish public bodies.
Top comments (0)