What Happened
In 2018, an attacker compromised Vastaamo, a Finnish psychotherapy provider, extracting a database containing records for approximately 33,000 patients. The breach remained undetected until 2020, when the attacker first attempted to extort the company. When Vastaamo refused to pay, the attacker shifted tactics and sent ransom demands directly to more than 24,000 individual patients, threatening to publish their confidential therapy notes unless they paid. When many victims refused, the attacker followed through and published highly sensitive mental health records online.
The stolen data included therapy session notes, diagnoses, and treatment details for some of Finland's most vulnerable populations, including children and individuals receiving treatment for severe psychological trauma. The Court of Appeal later determined the crimes were "carefully planned, driven by financial gain and caused exceptional harm to a large number of especially vulnerable victims."
Timeline
2018: Initial breach occurs. Attacker gains access to Vastaamo's patient database containing records for 33,000 individuals.
2020: Breach becomes public when the attacker demands payment from Vastaamo.
2020: After Vastaamo refuses, the attacker sends extortion demands directly to more than 24,000 patients.
2020: When many victims refuse to pay, confidential therapy records are published online.
February 2025: Finland's Court of Appeal convicts Aleksanteri Kivimäki of aggravated data breach, attempted extortion, and unlawfully distributing private information. He receives a sentence of nearly seven years.
September 2025: Court releases Kivimäki from pretrial detention.
2025: Finland's Supreme Court refuses to hear Kivimäki's appeal, making the conviction final. Police issue a wanted notice.
Which Controls Failed or Were Missing
The two-year gap between breach and detection points to fundamental failures across multiple control domains:
Access Control and Authentication: The attacker gained unauthorized access to a database containing 33,000 patient records. This suggests failures in implementing the Principle of Least Privilege and inadequate authentication mechanisms protecting access to protected health information.
Logging and Monitoring: A breach that goes undetected for two years indicates missing or ineffective security event logging. Your SIEM should flag unusual database queries, especially bulk exports of patient records. Vastaamo either wasn't collecting these logs or wasn't monitoring them.
Data Protection at Rest: The attacker extracted usable patient records, suggesting the database lacked encryption or the encryption implementation was compromised. Healthcare providers must encrypt electronic protected health information both in transit and at rest.
Incident Detection and Response: The organization discovered the breach only when the attacker initiated extortion, not through internal detection capabilities. This represents a complete failure of your Computer Security Incident Response Team function.
Vulnerability Management: The breach occurred in 2018 using methods that were likely detectable through regular vulnerability assessments and penetration testing. Your scanning and remediation cycle should identify database access vulnerabilities before attackers do.
Third-Party Risk Management: If Vastaamo used external vendors for database hosting or management (common for smaller healthcare providers), the breach may reflect inadequate vendor security assessments and ongoing monitoring.
What the Standards Require
HIPAA Security Rule (for U.S. healthcare organizations facing similar risks):
- §164.308(a)(1)(ii)(D) requires an information system activity review process. You must regularly review logs of system activity such as audit logs, access reports, and security incident tracking reports.
- §164.308(a)(6)(ii) requires security incident procedures for responding to and reporting security incidents.
- §164.312(a)(1) requires access controls, including unique user identification and emergency access procedures.
- §164.312(a)(2)(iv) mandates encryption of electronic protected health information or documentation of why encryption isn't reasonable and appropriate.
General Data Protection Regulation:
- Article 32 requires appropriate technical and organizational measures to ensure security appropriate to the risk, specifically mentioning encryption and the ability to restore availability after an incident.
- Article 33 establishes the 72-Hour Notification Requirement for notifying supervisory authorities of personal data breaches.
- Article 5(1)(f) requires data to be "processed in a manner that ensures appropriate security of the personal data."
ISO/IEC 27001 provides the ISMS framework many healthcare organizations use:
- A.8.2 requires controls for privileged access rights.
- A.8.16 addresses monitoring for unusual activity and security events.
- A.8.24 mandates use of cryptography to protect sensitive information.
- A.5.24 through A.5.28 cover information security incident management planning, assessment, response, and learning.
NIST Cybersecurity Framework (CSF) 2.0:
- DE.CM-01: Networks and network services are monitored to find potentially adverse events.
- DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events.
- PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected.
- RS.MA-01: Incidents are contained.
Lessons and Action Items for Your Team
Implement continuous database monitoring. Your data loss prevention tools should flag bulk exports of patient records. Configure alerts for database queries that access more than a threshold number of records within a defined timeframe. For a psychotherapy practice, any query returning hundreds of patient records should trigger immediate investigation.
Encrypt your patient database with field-level encryption. Don't rely solely on full-disk encryption. Implement encryption at the field level for diagnosis codes, treatment notes, and personally identifiable information. This ensures that even if an attacker extracts the database, the data remains unusable without the decryption keys, which you store separately with strict access controls.
Test your incident response plan against this scenario. Run a tabletop exercise where your Computer Security Incident Response Team discovers evidence of database exfiltration from two years ago. Can you determine what was accessed? Can you identify affected individuals? Do you know your notification obligations under both HIPAA and the General Data Protection Regulation if you serve EU patients?
Reduce your detection gap to hours, not years. Deploy User and Entity Behavior Analytics to establish baseline access patterns for database administrators and applications. Any deviation from normal query patterns, access times, or data volumes should generate alerts that your security operations center investigates within your defined response timeframe.
Document your encryption decisions. If you're subject to HIPAA, you must either encrypt electronic protected health information or document why encryption isn't reasonable and appropriate. The Vastaamo case demonstrates why "we haven't gotten around to it" won't satisfy regulators or courts after a breach.
Establish breach notification runbooks now. You need documented procedures for notifying 24,000 individuals. Who drafts the notification language? Who reviews it for legal compliance? How do you verify contact information? How do you handle returned mail? The middle of a crisis is not when you want to figure this out.
The Vastaamo breach became Finland's largest criminal case by victim count because basic controls failed. Your organization likely has more sophisticated tools than a mid-sized psychotherapy provider. The question is whether you're actually using them to detect the breach that's already happened but you haven't found yet.
