News
The article is more than 4 years old

Extortionist publishes more sensitive data on psychotherapy centres’ patients

Vastaamo treats patients for the Oulu and Tampere university hospital systems, including children and youth.

Kuvassa on Vastaamon verkkosivu tietokoneen ruudulla.
Vastaamo has 22 locations around the country. Image: Silja Viitala / Yle
  • Yle News

A blackmailer demanding money from a group of psychotherapy centres has released more highly sensitive personal information about more than 200 of its patients.

The perpetrator has threatened to publish more on a daily basis unless the Vastaamo psychotherapy centre firm pays a ransom of nearly half a million euros.

A second batch of about 100 patient reports appeared early Thursday on the anonymous Tor network, bringing the total to more than 200. They include highly intimate information about Vastaamo customers’ personal lives and mental health issues, along with their names, addresses and social security numbers.

The unknown extortionist has published messages in English purporting to be correspondence with representatives of the company. The blackmailer is demanding that Vastaamo pay 40 bitcoins in order to halt the release of more patient data. The cryptocurrency sum corresponds to about 450,000 euros.

Data on children and youth may have been exposed

The perpetrator claims to have information on 40,000 patients. The company says it has tens of thousands of customers but has not confirmed how many of them may have been affected by the data hack.

Vastaamo says the data hack does not appear to have compromised any data from after November 2018.

The firm employs about 300 psychotherapists, who work at 22 offices around the country.

Yle has viewed the released patient data and compared it with other information sources including the Population Registry and social media, and confirmed that the data is associated with actual individuals and appears to be genuine.

Detective Inspector Marko Leponen of the National Bureau of Investigation (NBI) confirmed to Yle that it is investigating a case of aggravated data theft that matches the description of this case. However, he declined to confirm the name of the company involved.

Vastaamo is or has been a service contractor for a variety of public sector bodies, treating patients referred by Oulu University Hospital (OYS) and Tampere University Hospital (TAYS), for instance. Some of the TAYS patients treated at Vastaamo offices are children and youth.