Finnish Hacker Faces Justice for Vastaamo Attack

Aleksanteri Kivimäki, a 26-year-old hacker, has been sentenced to six years’ imprisonment. Local media reported this, citing a court decision related to the breach of the private psychotherapeutic center Vastaamo in Helsinki.

The court found Kivimäki guilty in more than 9,200 cases of disseminating information that infringed on individuals’ private lives, over 20,000 attempts at blackmail, and 20 instances of extortion. Additionally, Kivimäki faces more than 5,000 claims for damages.

According to Finnish police, around 22,000 victims reported extortion attempts demanding up to €500 each. Initially, Kivimäki demanded 40 BTC from Vastaamo, but after the company was reluctant to engage, he attempted an alternative approach. The hacker began sending letters to clients demanding varying amounts from €200 to €500, promising in return not to disclose details of their sessions with psychologists.

The attack on Vastaamo began in 2018. As a result, not only were the sensitive data of about 33,000 patients stolen, but also financial information, which the perpetrator used for fraud. After the institution refused to meet the hacker’s demands, some patients’ data was leaked on the darknet.

Some media noted that the Vastaamo breach and the extortion of patients “profoundly shook Finnish society” and called the attack a “turning point for Finland.”

During the investigation, police were able to trace cryptocurrency transactions and eventually track down Kivimäki, despite the criminal’s attempts to convert the funds to Monero, a cryptocurrency previously considered completely anonymous and untraceable.

In late October 2022, Kivimäki was charged (and was also arrested in absentia, as he was in France) with attempting to extort money from the Vastaamo psychotherapy center. On October 21, 2020, the Vastaamo clinic became the target of blackmail, when the perpetrator demanded 40 bitcoins in exchange for a promise not to publish confidential records of therapeutic sessions.

For his actions, Aleksanteri Kivimäki, who at 17 was accused of more than 50,000 cybercrimes, made the list of Interpol’s most wanted criminals in 2022, and in February 2023, he was arrested in France.