The Vastaamo Cyber Attack: Finland's Cruelest Hack and the Hunt for 'Ransom Man'

The Vastaamo Cyber Attack

• 💡 In October 2020, a hacker known as "Ransom Man" breached Vastaamo, a major Finnish psychotherapy company, stealing personal details and sensitive therapy notes of 33,000 clients.
• 🎯 Ransom Man demanded 400,000 euros in Bitcoin from Vastaamo, threatening to release the data if the ransom was not paid.
• ⚠️ Vastaamo contacted the police, initiating a six-week negotiation period before Ransom Man began releasing patient records daily.

The Cruelty of Exposed Secrets

• 🧠 Ransom Man specifically selected the most "salacious" and "harmful" records for initial release, searching for keywords related to abuse and fantasies.
• 💔 The exposed data included deeply personal therapy notes, causing immense fear and distress to vulnerable individuals, with some victims describing the experience as "digital rape."
• 📉 The hacker's actions were widely condemned, with little sympathy shown on darknet forums, and the data was posted on sites known for extreme content.

A Critical Mistake and a Race Against Time

• 🔑 Ransom Man made a critical error by uploading a 10GB file containing all patient data and his own personal information to a darknet forum, intending to be helpful but giving away his leverage.
• 🏃‍♂️ Finnish police, alerted to the upload, raced to download the file before Ransom Man could delete it, successfully obtaining a 2GB portion that contained a crucial IP address.
• ⚡ This IP address led investigators to a cloud-hosting provider in Helsinki, allowing them to seize the server and gather extensive evidence against the hacker.

The Hacker's Identity and Continued Extortion

• 🔍 The investigation pointed towards Julius Kivimaki, a notorious Finnish hacker previously known as "Ryan" from the Lizard Squad, who had previously taken down PlayStation and Xbox networks.
• 📧 After failing to extort Vastaamo, Ransom Man directly emailed approximately 27,500 patients, demanding 200-500 euros in Bitcoin to prevent their data from being published.
• ⚖️ This direct extortion of victims marked a new low in cybercrime, overwhelming both Vastaamo and the Finnish police with complaints.

The Hunt for Kivimaki and Legal Ramifications

• 🌍 An Interpol Red Notice was issued for Kivimaki, who was eventually apprehended in Paris in early 2023.
• 📈 Kivimaki's trial in Finland became the country's largest criminal case, with over 9,000 victims filing complaints and 20,000 attempted extortion emails identified.
• ⛓️ Despite being released on bail mid-trial, Kivimaki absconded, leading to another manhunt before his eventual re-arrest and sentencing to six years and three months in prison.

Vastaamo's Collapse and CEO's Prosecution

• 📉 The Vastaamo company collapsed into administration due to the breach, loss of trust, and legal issues, unable to recover from the catastrophic event.
• 🧑‍⚖️ The CEO, Ville Tapio, was prosecuted and convicted for data protection violations under GDPR, receiving a suspended prison sentence, though he is appealing the decision.
• 🌐 The case highlighted systemic issues in data protection and the Finnish justice system's capacity to handle large-scale cybercrime.