GDPR

“Ville Tapio, he would say that the company could have survived if he’d had been allowed to keep operating it and kind of steered the ship through this crisis, but he was dropped very, very quickly as soon as the investigators began poking around. JACK: When Vastaamo got the ransom note from Ransom Man, they called the police, and the police took over the situation. They took over the CEO’s e-mail and they were responding to Ransom Man, posing as the CEO. They were advising Vastaamo how to react to everything, and the police weren’t trying to save the reputation of the company. They were trying to solve the case of who did it, so they had a totally different priority than maybe the Vastaamo leadership. So, the CEO of Vastaamo didn’t have control of the ship in the middle of this crisis. The police did. JOE: Not only had Ransom Man managed to get hold of this data in 2018; someone else somewhere — we don’t know who, we don’t know what happened; they got hold of it in 2019 or they had access to it, and there was still a lot of confusion here about whether or not there was a cover-up. [Music] Tapio denies that vociferously. The IT team that he hired have gone dark. They don’t — they haven’t spoken to anybody. So, we don’t know exactly the nature of that, but the Vastaamo hack, Ransom Man, plus this incident in 2019, it just meant the company was in absolute chaos and crisis, and legal problems as well. You can imagine data protection authorities breathing down their necks. They had fines to pay. Then you’ve just got the fact that there was tens of thousands of people who just could no longer trust the company, and the way they handled it was atrocious. People were turning up at the therapy centers demanding their notes to be handed over, and some of the staff were in tears. It was just utter, utter devastation, and the company collapsed into administration. JACK: The company collapsed. Wow. It’s pretty rare for a company to be damaged so badly from a cyber attack that it can’t recover and has to shut down like this. It’s wild to think that your whole business could come to a catastrophic end all because of a hacker. But all this does make you wonder, whose fault is it for not securing the customers’ data better, and shouldn’t they be held responsible? JOE: Well, Ville Tapio, the CEO, he has been prosecuted for… JACK: Really? JOE: …for failing to protect the data, but he’s appealing that and we don’t know what’s gonna happen with that. JACK: The CEO blames his IT team for failing to protect the data, and he blames the police for how badly the fallout was handled. He says when he called the NBI, the National Bureau of Investigation, they locked him out of all decision-making, and he didn’t even know what was being said in e-mails using his name. Pretty early in the investigation, the NBI filed a criminal complaint against the CEO accusing him of a data protection violation, which led the board to remove him as CEO in the middle of this crisis while people were trying to call 24/7 looking for help. So, the company was leaderless during all this, and not only was he dismissed as the CEO, but the parent company of Vastaamo also sued him, accusing him of failing to protect user data. Ville Tapio, the CEO, was convicted in the District Court of Helsinki for data protection violations under the EU’s General Data Protection Regulations”