IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Hackers demand ransom from therapy patients after clinic data breach

Vastaamo CEO Ville Tapio was reportedly fired for obscuring information about the incident for more than two years

Distressed girl talks to shrink with notepad

A hacker is trying to blackmail thousands of Finish patients after gaining access to their personal information via a psychotherapy company. 

Police have said that an unknown party started demanding ransom from more than 40,000 patients whose data was stolen from the Vastaamo psychotherapy centre, according to local media reports

The data was taken during a cyber attack in November 2018, and potentially again in March 2019, the Helskinki-based centre said in a statement.

The company is cooperating with the police, but it's reported that some 300 records have already been published on the dark web. It is also being reported that the firm's CEO, Ville Tapio, has been fired for obscuring information about the data breach for more than two years. 

The hackers originally sought to extort a ransom from the centre's management but changed tactics over the weekend to elicit payments from individuals that had used the service. 

Various patients have spoken to media outlets to say that the hackers have contacted them and threatened to leak mental health records onto the internet unless they provide payment in Bitcoin. Some of the people whose data has been stolen are also underage. 

One patient told the BBC that the hacker said Vastaamo had refused to pay 40 Bitcoin (£403,000) and he would now have to pay €200 worth in order to stop his information being released - this included session notes from when he was a teenager. 

"I'm anxious about the fact that the attackers are in possession of my notes and conversations from those psychiatrist sessions," he said. "Those notes contain things I'm not ready to share with the world. And having someone threaten me with said notes certainly makes me extremely uncomfortable."

The patient's notes had been taken in a physical notebook and he/she wasn't told these would be uploaded to a server. The country's prime minister Sanna Marin tweeted that the Finish government was looking into ways to support the victims of what he called a "shocking" hack. 

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Ten ways to protect your company from the next big data breach
data breaches

Ten ways to protect your company from the next big data breach

18 Feb 2022
Gumtree site code made personal data of users and sellers publicly accessible
data protection

Gumtree site code made personal data of users and sellers publicly accessible

16 Dec 2021
Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021

Most Popular

Actively exploited server backdoor remains undetected in most organisations' networks
cyber attacks

Actively exploited server backdoor remains undetected in most organisations' networks

1 Jul 2022
Former Uber security chief to face fraud charges over hack coverup
data breaches

Former Uber security chief to face fraud charges over hack coverup

29 Jun 2022
Why India wants to become a chipmaking powerhouse
components

Why India wants to become a chipmaking powerhouse

28 Jun 2022