The Vastaamo psychotherapy clinic hack and extortion attempt in Finland, first disclosed in 2020, remains one of the most sensitive and disturbing breaches DataBreaches has ever covered. Past news items about it can be found here. Now there is an update. Aleksi Teivainen of Helsinki Times reports: The District Court of Helsinki on Friday detained a 25-year-old man in absentia on suspicion of breaking into the patient register of Psychotherapy Centre Vastaamo. The Finnish man is suspected of aggravated computer break-in, attempted aggravated extortion and aggravated dissemination of information violating personal privacy. Investigators at the National Bureau of Investigation (KRP) are also looking into his possible ties to extorting and disseminating information on victims of the hacking. Read more at Helsinki Times. The English version of the police press release: One arrested in absentia in connection with Vastaamo’s data breach The Central Criminal Police has made progress in the investigation of the data breach targeting the Psychotherapy Center Vastaamo. In the preliminary investigation, a 25-year-old Finnish man has been arrested in absentia and wanted, whom the police suspect of the data breach targeting Vastaamo. A European arrest warrant has been issued for the person. Helsinki District Court is on Thursday 27 October. arrested one person in absentia with probable cause on suspicion of felony data breach, felony attempted extortion, and felony dissemination of information in violation of private life. The Central Criminal Police demanded an arrest in connection with the preliminary investigation of the data breach targeting the Psychotherapy Center Vastaamo, which the police first announced in October 2020. The police know that the suspect is currently staying abroad, which is why he was arrested in absentia. A European arrest warrant has been issued for the person, under which he can be arrested abroad. After the arrest, the police request the extradition of the suspect to Finland. An Interpol international wanted notice will also be issued for the suspect. The suspect is a 25-year-old Finnish citizen. The police have made significant progress in the investigation. This point has been reached with long-term and careful work. In the preliminary investigation, there has been close cooperation between both police departments and other authorities in Finland and internationally. It is still too early to estimate the time when the preliminary investigation can be considered for charges, says the head of the investigation, crime commissioner Marko Leponen from the Central Criminal Police. The preliminary investigation is still ongoing. The police are also investigating the connection of the person suspected of the data breach to the extortion of the victims of the data breach and the dissemination of information. Victims are reminded to report a crime and fill out an electronic statement form About 22,000 interested parties have filed a criminal complaint with the police in connection with the case. Due to the exceptionally large number of victims, the hearings of the interested parties are carried out electronically. The police has only received about 6,400 electronic statements. We urge all victims to file a criminal complaint and those who filed a criminal complaint to give an electronic statement. It’s worth filling out the statement form, because that way you stay involved in the criminal process and get the opportunity to present your claims in the case, says Leponen. According to the police’s estimate, around 10,000 victims have not filed a criminal report. The police urges you to file a criminal complaint if your personal information has been leaked online or you have received a blackmail message related to the data breach of Vastaamo Psychotherapy Centre. Interested parties who have filed a criminal report can fill out the declaration form on their own through the police’s electronic transaction platform. You can find instructions for filing a criminal report and an electronic statement on the police’s website. Police instructions for the victims of the Vastaamo data breach

A hack and extortion attempt involving the psychotherapy center in Vastaamo, Finland was — and remains — one of the worst breaches ever covered on PogoWasRight.org and DataBreaches.net because it involved the sensitive mental health information of tens of thousands of patients and a coverup by an executive of the clinic. Now EDPB has posted an enforcement action by Finland: Background information Date of final decision: 7 December 2021 Cross-border case or national case: National case Controller: Psychotherapy centre Vastaamo Legal Reference: Notification of a personal data breach to the supervisory authority (Art. 33(1)), Communication of a personal data breach to the data subject (Art. 34(1)), Principles of integrity and confidentiality (Art. 5(1)(f)), Data protection impact assessment (Art. 35), Responsibility of the controller (Art. 24), Data protection by design and by default (Art. 25), Security of processing (Art. 32), Accountability (Art. 5(2)) Decision: Infringement of the GDPR, administrative fine and reprimand Key words: personal data breach, patient data Summary of the Decision Origin of the case The psychotherapy centre Vastaamo notified the Data Protection Ombudsman about an attack against its patient record database in September 2020. In October 2020, the Office of the Data Protection Ombudsman started an investigation into the legality of Vastaamo’s operations. Key Findings Vastaamo neglected its duties related to the safe processing of personal data as well as reporting a personal data breach. Based on a technical investigation by the data security company Nixu in October 2020, the Deputy Data Protection Ombudsman finds that Vastaamo must have become aware that the patient data had disappeared and that it may have ended up in the possession of an external attacker already in March 2019. Vastaamo should have reported the breach both to the supervisory authority and its customers without delay. The Deputy Data Protection Ombudsman finds that the personal data had not been appropriately protected against unauthorised and illegal processing or accidental disappearance, and Vastaamo had not implemented basic measures to ensure the safe processing of personal data. Due to insufficient documentation, Vastaamo was not able to prove that it would have complied with the appropriate safety requirements, either. Decision The Deputy Data Protection Ombudsman issued Vastaamo a reprimand on violating the GDPR. The sanctions board of the Office of the Data Protection Ombudsman imposed an administrative financial sanction of EUR 608 000 on Vastaamo. The sanctions board considers the acts of negligence extremely serious and Vastaamo’s actions in neglecting the duty to notify intentional. Furthermore, the violations were long-lasting. Vastaamo was declared bankrupt in February 2021. An administrative fine is the lowest priority claim in a bankruptcy. Therefore, the financial sanction will not reduce the funds available for other claims in bankruptcy, such as potential compensation for damages. For further information: Decision of the Deputy Data Protection Ombudsman and the sanctions board in Finlex (FI) Press release: Administrative fine imposed on psychotherapy centre Vastaamo for data protection violations (EN) The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.