Joe Tidy says he is the BBC's cyber correspondent.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“I’m the BBC’s cyber correspondent.”
Episode
03 June 2025 Official episode · Official transcript
black hat cybercrime
The episode discusses the 2020 Vastaamo psychotherapy-centre breach, the extortion of the company and its patients, the investigation into Ransom Man, and the identification and prosecution of Julius Kivimaki.
Topics: Vastaamo psychotherapy-record breach, Personal and therapy-note data exposure, Data extortion and victim-level ransom demands, Bulk publication of stolen records, Default credentials: “root root”, Tor and darknet hosting, Cloud-hosted server identification through leaked IP data, Server seizure and digital evidence preservation, DDoS attacks against online gaming services, Cybercrime investigations and Interpol Red Notices, Data protection, anonymization, and encryption, GDPR data-protection violations
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Joe Tidy says he is the BBC's cyber correspondent.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“I’m the BBC’s cyber correspondent.”
Joe Tidy says he previously worked at Sky News as a general correspondent.
Explicit Confidence 98% · Joe Tidy EP 159 Details
“before that, I was at Sky News, and I was a general correspondent at Sky News”
Joe Tidy AUTHORED Ctrl+Alt+Chaos
Joe Tidy published the book Ctrl+Alt+Chaos.
Explicit Confidence 99% · Jack Rhysider EP 159 Details
“he just published a book called Ctrl+Alt+Chaos”
Ryan MEMBER_OF Lizard Squad
Ryan identifies himself as one of the hackers associated with Lizard Squad during the Sony and Xbox attacks.
Explicit Confidence 90% · Joe Tidy EP 159 Details
“this man who calls himself Ryan says he is one of the hackers”
Sony PlayStation Network and Xbox Live DDoS attack INVOLVES Lizard Squad
The 2014 attack on Sony PlayStation Network and Xbox Live involved Lizard Squad.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“these teenagers called Lizard Squad”
Sony PlayStation Network and Xbox Live DDoS attack INVOLVES DDoS attack
The Sony PlayStation Network and Xbox Live incident was described as a major DDoS attack.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“this amazingly huge and incredible DDOS attack on Sony PlayStation Network and Xbox Live”
Ryan USES DDoS attack
Ryan admits involvement in taking down Xbox Live and PlayStation Network in the DDoS attack.
Explicit Confidence 94% · Jack Rhysider EP 159 Details
“this kid calling himself Ryan appearing on Sky News not hiding his face or voice at all, admitting to taking down Xbox Live and PlayStation”
Vastaamo cyber attack COMPROMISES Vastaamo
The Vastaamo cyber attack compromised Vastaamo and its patient records.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“I have hacked the Vastaamo psychotherapy center”
Vastaamo cyber attack ATTRIBUTED_TO Ransom Man
The attack was initially attributed through Ransom Man's own claim that he had hacked Vastaamo and possessed its clients' data.
Attributed Confidence 98% · Joe Tidy EP 159 Details
“they were calling themselves Ransom Man and they were saying, I have hacked the Vastaamo psychotherapy center”
Vastaamo cyber attack INVOLVES Ransom Man
Ransom Man is the actor who communicated the ransom demands and disclosed patient records in the incident.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“Ransom Man said, I have been trying to get 400,000 euros”
Vastaamo cyber attack INVOLVES data extortion
The attacker attempted to extort Vastaamo and later its patients by threatening to publish stolen data.
Explicit Confidence 99% · Jack Rhysider EP 159 Details
“all I want is Bitcoin or else I’m gonna release it to the world”
Vastaamo cyber attack INVOLVES bulk data disclosure
The incident involved repeated publication of patient records and an accidental upload containing the data of approximately 33,000 patients.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“he accidentally did was posted his entire home directory and the entire list and all the data from the 33,000 patients”
Vastaamo cyber attack INITIAL_ACCESS_VIA default credentials
According to Ransom Man's forum statement, access to the database was easy because it had no password and used the credentials 'root root'.
Attributed Confidence 95% · Joe Tidy EP 159 Details
“there was no password. It was ‘root root’”
Ransom Man USES Torilauta
Ransom Man used Torilauta to announce the Vastaamo compromise, threaten publication, and publish records.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“he posted it on the darknet on a website which is now gone, but it was called Torilauta”
Ransom Man USES Ylilauta
Ransom Man also posted the stolen records and threats on the clearweb forum Ylilauta.
Explicit Confidence 99% · Joe Tidy EP 159 Details
“As well as posting on Torilauta, he posted it to a clearweb forum called Ylilauta”
Vastaamo cyber attack INVOLVES Tor
The attacker used Tor/the darknet to host and distribute the stolen data.
Explicit Confidence 98% · Jack Rhysider EP 159 Details
“he posted it on the darknet on Tor”
Vastaamo cyber attack INVOLVES Finnish police
The Finnish police investigated the incident, archived the disclosures, and pursued the attacker.
Explicit Confidence 99% · Jack Rhysider EP 159 Details
“the Finnish police were already very aware of this situation because they were working with Vastaamo”
Vastaamo cyber attack INVOLVES National Bureau of Investigation
The National Bureau of Investigation became involved in the response and investigation, including locking Ville Tapio out of decision-making according to his account.
Explicit Confidence 97% · Jack Rhysider EP 159 Details
“when he called the NBI, the National Bureau of Investigation, they locked him out of all decision-making”
Vastaamo cyber attack ATTRIBUTED_TO Julius Kivimaki
Julius Kivimaki became the prime suspect, with investigator Marko Leponen finding evidence pointing toward him; the attribution is presented as investigative suspicion rather than an unqualified fact.
Uncertain Confidence 93% · Joe Tidy EP 159 Details
“this kid or this cyber criminal who was famous when he was a kid, infamous, rather, is probably the prime suspect. The name Julius Kivimaki just keeps coming up”
“the investigator, Marko, was finding actual evidence that was pointing to him”
Julius Kivimaki POSSIBLY_SAME_AS Ransom Man
The episode presents the possibility that Ransom Man was Julius Kivimaki, supported by speculation and investigative evidence, but does not treat the identity as certain at that point.
Uncertain Confidence 90% · Jack Rhysider EP 159 Details
“Could Ransom Man be him? Speculators were thinking it, but the investigator, Marko, was finding actual evidence that was pointing to him”
Marko Leponen MEMBER_OF Finnish police
Marko Leponen is identified as the head detective/main detective in the Finnish police investigation.
Derived Confidence 92% · Joe Tidy EP 159 Details
“I spoke to the head detective, Marko Leponen”
Julius Kivimaki MEMBER_OF HTP
Joe Tidy says Kivimaki was part of HTP and was convicted for activity associated with it.
Explicit Confidence 98% · Joe Tidy EP 159 Details
“Then after that you had HTP, which Kivimaki was part of and convicted for”
Julius Kivimaki MEMBER_OF Lizard Squad
Joe Tidy says Kivimaki was part of Lizard Squad among other teenage cyber-crime gangs.
Explicit Confidence 98% · Joe Tidy EP 159 Details
“there were other gangs he was part of like Lizard Squad and UGNazi, Isis gang”
Julius Kivimaki MEMBER_OF UGNazi
Joe Tidy says Kivimaki was part of UGNazi among other teenage cyber-crime gangs.
Explicit Confidence 98% · Joe Tidy EP 159 Details
“there were other gangs he was part of like Lizard Squad and UGNazi, Isis gang”
Julius Kivimaki MEMBER_OF Isis gang
Joe Tidy says Kivimaki was part of the Isis gang among other teenage cyber-crime gangs.
Explicit Confidence 98% · Joe Tidy EP 159 Details
“there were other gangs he was part of like Lizard Squad and UGNazi, Isis gang”
Vastaamo cyber attack INVOLVES GDPR
The aftermath involved data-protection enforcement and GDPR-related legal proceedings against Vastaamo's CEO.
Explicit Confidence 98% · Joe Tidy EP 159 Details
“Ville Tapio, he would say that the company could have survived if he’d had been allowed to keep operating it and kind of steered the ship through this crisis, but he was dropped very, very quickly as soon as the investigators began poking around. JACK: When Vastaamo got the ransom note from Ransom Man, they called the police, and the police took over the situation. They took over the CEO’s e-mail and they were responding to Ransom Man, posing as the CEO. They were advising Vastaamo how to react to everything, and the police weren’t trying to save the reputation of the company. They were trying to solve the case of who did it, so they had a totally different priority than maybe the Vastaamo leadership. So, the CEO of Vastaamo didn’t have control of the ship in the middle of this crisis. The police did. JOE: Not only had Ransom Man managed to get hold of this data in 2018; someone else somewhere — we don’t know who, we don’t know what happened; they got hold of it in 2019 or they had access to it, and there was still a lot of confusion here about whether or not there was a cover-up. [Music] Tapio denies that vociferously. The IT team that he hired have gone dark. They don’t — they haven’t spoken to anybody. So, we don’t know exactly the nature of that, but the Vastaamo hack, Ransom Man, plus this incident in 2019, it just meant the company was in absolute chaos and crisis, and legal problems as well. You can imagine data protection authorities breathing down their necks. They had fines to pay. Then you’ve just got the fact that there was tens of thousands of people who just could no longer trust the company, and the way they handled it was atrocious. People were turning up at the therapy centers demanding their notes to be handed over, and some of the staff were in tears. It was just utter, utter devastation, and the company collapsed into administration. JACK: The company collapsed. Wow. It’s pretty rare for a company to be damaged so badly from a cyber attack that it can’t recover and has to shut down like this. It’s wild to think that your whole business could come to a catastrophic end all because of a hacker. But all this does make you wonder, whose fault is it for not securing the customers’ data better, and shouldn’t they be held responsible? JOE: Well, Ville Tapio, the CEO, he has been prosecuted for… JACK: Really? JOE: …for failing to protect the data, but he’s appealing that and we don’t know what’s gonna happen with that. JACK: The CEO blames his IT team for failing to protect the data, and he blames the police for how badly the fallout was handled. He says when he called the NBI, the National Bureau of Investigation, they locked him out of all decision-making, and he didn’t even know what was being said in e-mails using his name. Pretty early in the investigation, the NBI filed a criminal complaint against the CEO accusing him of a data protection violation, which led the board to remove him as CEO in the middle of this crisis while people were trying to call 24/7 looking for help. So, the company was leaderless during all this, and not only was he dismissed as the CEO, but the parent company of Vastaamo also sued him, accusing him of failing to protect user data. Ville Tapio, the CEO, was convicted in the District Court of Helsinki for data protection violations under the EU’s General Data Protection Regulations”
Julius Kivimaki USES Interpor Red Notice
An Interpol Red Notice was issued to help locate and arrest Julius Kivimaki; the notice was used as part of the investigation's pursuit of him.
Explicit Confidence 78% · Joe Tidy EP 159 Details
“Marko does the quite extreme move of putting out an Interpol Red Notice to try and find out where he is”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:40:28.143697+00:00