Records she had never intended to show anyone had fallen into someone else's hands.
Cybercrime: Malice in Everyday Life — Part 5
You don't have to be someone special to be targeted.
Everyday life has unseen points of entry. Drawing on publicly available information, we trace how these threats unfold quietly and how their consequences eventually surface in everyday life.
From a Place She Had Forgotten
The email arrived on a Saturday night.
She did not recognise the sender. Assuming it was spam, she was about to delete it.
Then she noticed her name in the subject line.
The message referred to a psychotherapy centre she had attended several years earlier, when she was struggling with problems at work and at home.
It also contained personal details about her.
How could a stranger know any of this?
The sender claimed to have stolen patient information from the centre. Unless she paid by a specified deadline, the sender said, her therapy records would be published online.
At first, she thought it was just another malicious threat.
But the message did not look like an indiscriminate email sent to thousands of people. The sender knew she had been a client of that centre.
Perhaps they knew what she had talked about there, too.
Closing the email did nothing to settle her mind. She no longer felt she could sleep.
It Wasn't Only Her Secret
The email did not merely reveal that she had attended the centre. Some of its wording suggested that the sender knew what she had discussed there.
The sender also hinted that they had obtained information about other clients.
If that was true, it might not be only her records that had fallen into someone else's hands. The information of others who had sought help at the same place might have been taken as well.
She had no way of knowing how many people's records were involved, or how much information had been copied.
But the fact that something she had never shared with anyone had passed into a stranger's hands without her consent was frightening enough.
Having your information stolen does not simply mean losing a password or having your contact details exposed.
It can mean having a part of your life opened up to others without your permission.
Even Though She Had Done Nothing Wrong
She had not deceived anyone or taken part in a crime.
She had simply sought professional help at a difficult time.
And now, what she had shared in confidence was being used as leverage for extortion.
Even if the information was true, that did not give anyone the right to make it public.
People need places where they can seek help without having to worry that others will find out.
Wanting to keep something private does not mean there is anything shameful about it.
Difficulties with family, anxieties about work, uncertainties about oneself.
People can ask for help because there are places where they can talk about such things in confidence.
That trust had now been broken.
Some clients may not even have wanted others to know they had sought counselling. Others may have feared that disclosure of their records would change how people around them saw or treated them.
What happened was more than the theft of information.
The very things people most wish to keep private had been turned into tools for extracting money.
A Real Case Behind the Story
The account so far is not a recreation of events involving any particular victim or facility. It is a fictional story inspired by publicly available information and shaped by combining several circumstances.
But there is a real case behind it.
In October 2020, a large-scale breach involving the patient database of Vastaamo, a psychotherapy centre in Finland, became public. Subsequent technical investigations confirmed unauthorised access to the database at least as early as December 2018 and March 2019.
The stolen information was not limited to names and contact details. It also included highly sensitive material, such as patients' therapy records.
The centre received messages demanding money under threat of publishing patient information. Individual patients were also sent emails directly and threatened with the release of their personal information and therapy records unless they complied. The Finnish police have said that it is not known whether the same person was responsible for the extortion directed at the centre and the emails sent to individual patients.
Patient information was in fact published online.
Who Was Held Responsible?
The Finnish police conducted a large-scale investigation into the case.
In June 2021, the police announced that they had received more than 25,000 crime reports related to the extortion of victims of the incident. They believed the actual number of victims was even higher.
The figure of 25,000 refers to reports made to the police, not to a confirmed count of individual victims. Even so, it shows that the harm extended far beyond a small number of people.
Nor was the attacker the only source of concern.
Finland's data protection authority found serious shortcomings in Vastaamo's handling of patient information and in its obligations to report the data breach.
In December 2021, the centre was fined €608,000.
Criminal proceedings against the perpetrator also followed.
In April 2024, the court of first instance sentenced the defendant to six years and three months in prison. In February 2026, the Court of Appeal increased the sentence to six years and eleven months. In July of that year, the Supreme Court of Finland declined to grant leave to appeal, making the Court of Appeal's judgment final.
But the victims' privacy was not restored.
Who had saved the information that was published? Who had read it? How far had it spread?
There is no way to know everything.
The Assumption That "It Wasn't Important Information"
When we hear that our personal information has been exposed, it is easy to underestimate the consequences.
It's only my name and email address.
If someone gets my phone number, I can just change it.
I don't have valuable confidential information like a large corporation would.
But the value of information is not determined by each piece in isolation.
A name and address alone may not seem particularly serious. But when combined with the services someone uses, their purchase history, consultation records, daily activities, and relationships, those details can reveal a great deal about their life.
And it is no longer the person the information belongs to who decides how it will be used. That decision is made by whoever has obtained it.
Name, address, contact details
|
+
Service usage history
|
+
Consultation and inquiry details
|
v
A picture of someone's life
and circumstances
|
v
Impersonation, extortion,
and threats
Intrusion into relationships
and other misuse
Each detail may seem insignificant on its own. Combined, they can take on serious meaning for the person concerned.
The same is true for small businesses.
Customer addresses, purchase histories, enquiry details, and correspondence with business partners.
These are not merely business records. They are also parts of people's lives.
The Drawer We Thought We Had Closed
Following the incident, the Finnish police urged people who received extortion emails not to pay, to report the matter to the police, and to preserve evidence such as the emails themselves.
But even taking those steps could not bring back information that had already been leaked.
Every day, we entrust our information to a variety of services.
We shop. We visit hospitals. We contact support and counselling services. We hire people to do work for us.
Each time, we share not only our names and contact details, but also something about our circumstances.
It is difficult for users to constantly check whether all of that information is being properly protected.
That is why organisations entrusted with information have a responsibility to keep it safe.
"I have nothing worth stealing."
Was the drawer you thought was empty really empty?
And the person you entrusted with its key—will they take responsibility for keeping it safe, all the way to the end?
References
Finnish Police, National Bureau of Investigation, "NBI to continue criminal investigation into exceptionally large-scale hacking of psychotherapy customer files" (published October 27, 2020; English version published November 24, 2020).
https://poliisi.fi/en/-/nbi-to-continue-criminal-investigation-into-exceptionally-large-scale-hacking-of-psychotherapy-customer-filesFinnish Police, "Victims of Vastaamo hacking incident: In order to become a party in the criminal proceedings, report the crime" (June 23, 2021).
https://poliisi.fi/en/-/victims-of-vastaamo-hacking-incident-in-order-to-become-a-party-in-the-criminal-proceedings-report-the-crimeFinnish Government, Office of the Data Protection Ombudsman, "Administrative fine imposed on psychotherapy centre Vastaamo for data protection violations" (announced December 16, 2021; English version published December 27, 2021).
https://valtioneuvosto.fi/en/-/6927448/administrative-fine-imposed-on-psychotherapy-centre-vastaamo-for-data-protection-violationsSupreme Court of Finland (Korkein oikeus), "Korkein oikeus hylkäsi valituslupahakemuksen Vastaamon tietomurtoa ja sitä seuranneita kiristysrikoksia koskeneessa asiassa" "Supreme Court denies leave to appeal in the case concerning the Vastaamo data breach and subsequent extortion offences".
https://www.korkeinoikeus.fi/ajankohtaista/tiedote-ja-uutisarkisto/korkein-oikeus-hylkasi-valituslupahakemuksen-vastaamon-tietomurtoa-ja-sita-seuranneita-kiristysrikoksia-koskeneessa-asiassa/Finnish Government, "Advice for the victims of the data leak" (published October 25, 2020; English version published October 26, 2020).
https://valtioneuvosto.fi/en/-/6927448/advice-for-the-victims-of-the-data-leak
The account in the first part of this article is a fictional reconstruction combining facts and circumstances drawn from publicly available information, including the Vastaamo case. It does not recreate the events experienced by any particular victim or at any particular facility. The second part discusses the actual Vastaamo data breach described in the references above. The Finnish police have stated that it is not known whether the person who extorted the centre was also responsible for the extortion emails sent to individual patients.
The police, National Bureau of Investigation, Office of the Data Protection Ombudsman, Finnish Government, and Supreme Court mentioned in this article are Finnish public institutions.
Top comments (0)