Hacker accused of breaching Finnish psychotherapy center faces 30,000 charges

Finnish prosecutors have charged a hacker with more than 30,000 counts related to an alleged breach of a Helsinki-based private psychotherapy center.

The charges include attempted extortion and dissemination of information infringing on privacy, according to a statement published this week by the Finnish Public Prosecutor’s Office.

Aleksanteri Kivimäki, 26, formerly identified as Julius Kivimäki, has denied any wrongdoing. The Finnish national is currently in pre-trial detention, awaiting proceedings which are expected to begin in November. If convicted, he faces a maximum sentence of seven years in prison.

On Wednesday, during a press conference, the attorney general in charge of the case, Pasi Vainio, said Finnish media that the Kivimäki case is one of the most important in Finnish criminal history.

Kivimäki allegedly hacked the Finnish company Vastaamo, which operated dozens of psychotherapy centers across the country, in 2018, stealing the private treatment records of more than 33,000 patients. More than 21,000 of them subsequently filed complaints.

After stealing the records, Kivimäki allegedly attempted to extort more than $380,000 in bitcoin from Vastaamo and sent extortion letters to patients, demanding payments ranging from 200 to 500 euros (approximately $211 to $529) in exchange non-disclosure of their therapy session records. When Vastaamo refused to pay, the hacker published batches of patient information on the dark web, including records of those who were children at the time.

The stolen information was very sensitiveincluding social security numbers, phone numbers, and emails of patients, as well as doctors’ notes and transcripts of conversations between patients and mental health professionals.

Finnish media previously reported that the upcoming hearing will be “exceptionally large” since up to 500 victims linked to the hack psychotherapy center have expressed their desire to participate.

The district court ordered that the identities of those involved remain confidential due to the sensitivity of the matters.

A former member of the hacker group Lizard Squad, Kivimäki was stopped in February in France. Lizard Squad was most active in late 2014 and was subsequently blamed for incidents such as distributed denial-of-service attacks that took down the PlayStation and Xbox online gaming services, as well as plane bomb threats carrying the president of Sony Online Entertainment.

As a teenager, in 2015, Kivimäki was convicted of over 50,000 counts of computer crimes.

Daryna Antoniuk

Daryna Antoniuk is a freelance journalist for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe, and the state of the Ukraine-Russia cyberwar. She was previously a tech journalist for Forbes Ukraine. His work has also been published in Sifted, The Kyiv Independent and The Kyiv Post.