Probe into Vastaamo hacking case to complete in summer

The criminal investigation into the data breach against Psychotherapy Centre Vastaamo and the subsequent leak of sensitive customer data is expected to be completed in the late summer, said the National Police Board in a press release on Wednesday.

The police urge the victims of extortion or dissemination of information violating personal privacy to report the crime to the police and fill in the statement form available on Police e-services by the end of May.

The criminal investigation into the suspected offences in the Vastaamo hacking case, namely an aggravated computer break-in, attempted aggravated extortion and aggravated dissemination of information violating personal privacy, is expected to be referred to prosecution late this summer.

The current investigation only concerns the offences of extortion and attempted extortion committed on 23–24 October 2020 and the subsequent dissemination of information violating personal privacy, so the victims of these offences are asked to report the crime to the police.

Victims may also state their claims in the criminal matter on the statement form. If you have asked the prosecutor to present your claim for damages, the prosecutor will decide whether to do that in connection with the criminal matter if charges are brought.

The Vastaamo investigation has been exceptional in many ways. Due to an unprecedentedly high number of victims, the police have created new operating models for dealing with the criminal investigation process.

Roughly 24,000 victims have already reported a crime to the police in the case, and around 8,600 of them have also filled in the online statement form.

“This is by far the largest case the police have investigated. For this reason, we have developed new operating models, for example to interview more than 20,000 victims. Our aim has been to conduct the investigation smoothly and ensure that the legal rights of the victims are respected and that all victims are included in the criminal process. We have also sought to reduce the risk of further crimes against the victims, as criminals have made active attempts to exploit the leaked data,” said Head of Investigation, Detective Chief Inspector Marko Leponen of the National Bureau of Investigation.

The criminal investigation into the Vastaamo data breach started in autumn 2020 when Vastaamo requested the police to investigate a suspected computer break-in in which the hacker had gained access to sensitive customer data, and the company was threatened with disclosure of the data.

Later that autumn, these customer data were leaked on the dark web, and extortion messages were sent to Vastaamo’s customers.

The police suspect a 25-year-old Finnish man of an aggravated computer break-in, aggravated dissemination of information violating personal privacy and attempted aggravated extortion in the case.

The suspect is currently held on remand on probable cause. The police arrested the suspect in France in February 2023. He has already been interviewed by the National Bureau of Investigation, and further interviews and the gathering of forensic evidence are still ongoing.