Vastaamo cyber attack COMPROMISES Vastaamo
The Vastaamo cyber attack compromised Vastaamo and its patient records.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“I have hacked the Vastaamo psychotherapy center”
Incident
incident:vastaamo_cyber_attack
Also: Vastaamo attack, Vastaamo hack
Cybersecurity incident involving the compromise and publication of psychotherapy patients’ personal and therapy data from Vastaamo.
Cybersecurity incident involving the compromise and publication of psychotherapy patients’ personal and therapy data from Vastaamo.
“the Vastaamo cyber attack was in October 2020”
“the Vastaamo hack happened in 2018”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | COMPROMISES | Vastaamo | Explicit | 159 |
| outgoing | ATTRIBUTED_TO | Ransom Man | Attributed | 159 |
| outgoing | INVOLVES | Ransom Man | Explicit | 159 |
| outgoing | INVOLVES | data extortion | Explicit | 159 |
| outgoing | INVOLVES | bulk data disclosure | Explicit | 159 |
| outgoing | INITIAL_ACCESS_VIA | default credentials | Attributed | 159 |
| outgoing | INVOLVES | Tor | Explicit | 159 |
| outgoing | INVOLVES | Finnish police | Explicit | 159 |
| outgoing | INVOLVES | National Bureau of Investigation | Explicit | 159 |
| outgoing | ATTRIBUTED_TO | Julius Kivimaki | Uncertain | 159 |
| outgoing | INVOLVES | GDPR | Explicit | 159 |
Vastaamo cyber attack COMPROMISES Vastaamo
The Vastaamo cyber attack compromised Vastaamo and its patient records.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“I have hacked the Vastaamo psychotherapy center”
Vastaamo cyber attack ATTRIBUTED_TO Ransom Man
The attack was initially attributed through Ransom Man's own claim that he had hacked Vastaamo and possessed its clients' data.
Attributed Confidence 98% · Joe Tidy EP 159 Details
“they were calling themselves Ransom Man and they were saying, I have hacked the Vastaamo psychotherapy center”
Vastaamo cyber attack INVOLVES Ransom Man
Ransom Man is the actor who communicated the ransom demands and disclosed patient records in the incident.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“Ransom Man said, I have been trying to get 400,000 euros”
Vastaamo cyber attack INVOLVES data extortion
The attacker attempted to extort Vastaamo and later its patients by threatening to publish stolen data.
Explicit Confidence 99% · Jack Rhysider EP 159 Details
“all I want is Bitcoin or else I’m gonna release it to the world”
Vastaamo cyber attack INVOLVES bulk data disclosure
The incident involved repeated publication of patient records and an accidental upload containing the data of approximately 33,000 patients.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“he accidentally did was posted his entire home directory and the entire list and all the data from the 33,000 patients”
Vastaamo cyber attack INITIAL_ACCESS_VIA default credentials
According to Ransom Man's forum statement, access to the database was easy because it had no password and used the credentials 'root root'.
Attributed Confidence 95% · Joe Tidy EP 159 Details
“there was no password. It was ‘root root’”
Vastaamo cyber attack INVOLVES Tor
The attacker used Tor/the darknet to host and distribute the stolen data.
Explicit Confidence 98% · Jack Rhysider EP 159 Details
“he posted it on the darknet on Tor”
Vastaamo cyber attack INVOLVES Finnish police
The Finnish police investigated the incident, archived the disclosures, and pursued the attacker.
Explicit Confidence 99% · Jack Rhysider EP 159 Details
“the Finnish police were already very aware of this situation because they were working with Vastaamo”
Vastaamo cyber attack INVOLVES National Bureau of Investigation
The National Bureau of Investigation became involved in the response and investigation, including locking Ville Tapio out of decision-making according to his account.
Explicit Confidence 97% · Jack Rhysider EP 159 Details
“when he called the NBI, the National Bureau of Investigation, they locked him out of all decision-making”
Vastaamo cyber attack ATTRIBUTED_TO Julius Kivimaki
Julius Kivimaki became the prime suspect, with investigator Marko Leponen finding evidence pointing toward him; the attribution is presented as investigative suspicion rather than an unqualified fact.
Uncertain Confidence 93% · Joe Tidy EP 159 Details
“this kid or this cyber criminal who was famous when he was a kid, infamous, rather, is probably the prime suspect. The name Julius Kivimaki just keeps coming up”
“the investigator, Marko, was finding actual evidence that was pointing to him”
Vastaamo cyber attack INVOLVES GDPR
The aftermath involved data-protection enforcement and GDPR-related legal proceedings against Vastaamo's CEO.
Explicit Confidence 98% · Joe Tidy EP 159 Details
“Ville Tapio, he would say that the company could have survived if he’d had been allowed to keep operating it and kind of steered the ship through this crisis, but he was dropped very, very quickly as soon as the investigators began poking around. JACK: When Vastaamo got the ransom note from Ransom Man, they called the police, and the police took over the situation. They took over the CEO’s e-mail and they were responding to Ransom Man, posing as the CEO. They were advising Vastaamo how to react to everything, and the police weren’t trying to save the reputation of the company. They were trying to solve the case of who did it, so they had a totally different priority than maybe the Vastaamo leadership. So, the CEO of Vastaamo didn’t have control of the ship in the middle of this crisis. The police did. JOE: Not only had Ransom Man managed to get hold of this data in 2018; someone else somewhere — we don’t know who, we don’t know what happened; they got hold of it in 2019 or they had access to it, and there was still a lot of confusion here about whether or not there was a cover-up. [Music] Tapio denies that vociferously. The IT team that he hired have gone dark. They don’t — they haven’t spoken to anybody. So, we don’t know exactly the nature of that, but the Vastaamo hack, Ransom Man, plus this incident in 2019, it just meant the company was in absolute chaos and crisis, and legal problems as well. You can imagine data protection authorities breathing down their necks. They had fines to pay. Then you’ve just got the fact that there was tens of thousands of people who just could no longer trust the company, and the way they handled it was atrocious. People were turning up at the therapy centers demanding their notes to be handed over, and some of the staff were in tears. It was just utter, utter devastation, and the company collapsed into administration. JACK: The company collapsed. Wow. It’s pretty rare for a company to be damaged so badly from a cyber attack that it can’t recover and has to shut down like this. It’s wild to think that your whole business could come to a catastrophic end all because of a hacker. But all this does make you wonder, whose fault is it for not securing the customers’ data better, and shouldn’t they be held responsible? JOE: Well, Ville Tapio, the CEO, he has been prosecuted for… JACK: Really? JOE: …for failing to protect the data, but he’s appealing that and we don’t know what’s gonna happen with that. JACK: The CEO blames his IT team for failing to protect the data, and he blames the police for how badly the fallout was handled. He says when he called the NBI, the National Bureau of Investigation, they locked him out of all decision-making, and he didn’t even know what was being said in e-mails using his name. Pretty early in the investigation, the NBI filed a criminal complaint against the CEO accusing him of a data protection violation, which led the board to remove him as CEO in the middle of this crisis while people were trying to call 24/7 looking for help. So, the company was leaderless during all this, and not only was he dismissed as the CEO, but the parent company of Vastaamo also sued him, accusing him of failing to protect user data. Ville Tapio, the CEO, was convicted in the District Court of Helsinki for data protection violations under the EU’s General Data Protection Regulations”