French police have arrested a 25-year-old Finnish man accused of hacking a psychotherapy clinic, stealing more than 22,000 patients' therapy notes, demanding ransom payments from them and also leaking this very private info on a Tor website.

The suspect, who was arrested on February 3, remains in French custody while he awaits extradition to Finland. While the Finnish police didn't release the man's name, infosec journalist Brian Krebs [1]reports that he's Julius "Zeekill" Kivimäki, who has previously been convicted of "tens of thousands of cybercrimes."

Finnish authorities issued a warrant for his arrest in October 2022. At the same time, Kivimäki was "arrested in absentia" by the Helsinki District Court for aggravated attempted extortion, aggravated computer break-in and aggravated dissemination of information violating personal privacy, according to the local cops.

[2]

The court will hold a new remand hearing once Kivimäki is sent back to Finland. "The aim is to interview the suspect as soon as possible," Marko Leponen, detective chief inspector of the National Bureau of Investigation, said in a [3]statement . Leponen is leading the investigation.

[4]

[5]

Back in October, Psychotherapy Center Vastaamo [6]admitted the data breach after patients' stolen details started appearing on the dark web.

"In recent days, the blackmailer has published sections of the information he obtained during the hacking," the Helsinki-based clinical chain said at the time. "Now the blackmailer has begun to approach the victims of the breach with blackmail letters demanding a ransom."

[7]

The now-ex CEO of Vastaamo, Ville Tapio, was later [8]charged with data protection offenses, and the psychotherapy center declared bankruptcy.

Oddly, by the time the Vastaamo came clean about the stolen data in October 2022, the breach was more than three years old.

[9]Hackers rummaged about in Finnish psychotherapy clinic – now patients extorted with public data dump threats

[10]Eurocops shut down Exclu encrypted messaging app, arrest dozens

[11]Iran crew stole Charlie Hebdo database, says Microsoft

[12]Former Ubiquiti dev pleads guilty in data theft and extortion case

Company chairman Tuomas Kahri told local newspaper Helsingin Sanomat ( [13]in Finnish ) that "no information has been leaked since November 2018". He added, in a statement on the clinic's website first issued last week, that "it is likely that our system [was also] infiltrated between the end of November 2018 and March 2019."

Patients were reportedly [14]blackmailed for €200 each, and the price tag jumped to €500 if the initial demand wasn't paid within 24 hours, according to Krebs. Plus, in addition publishing names and contact details, which other cybercriminals could use for identity theft, the miscreant threatened to leak patients' therapy session notes.

Law enforcement and security researchers estimate that the crook stole between [15]32,000 and [16]40,000 patients' sensitive information. As of October, 22,000 victims had reported the crime to the police.

[17]

Kivimäki also had the dubious honor of being named one of [18]Europol's Most Wanted Fugitives last year. ®

Get our [19]Tech Resources



[1] https://krebsonsecurity.com/2023/02/finlands-most-wanted-hacker-nabbed-in-france/

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y@OA0X8krG99ITKTtMlE1AAAAFg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://poliisi.fi/en/-/suspect-of-vastaamo-hacking-case-arrested-in-france

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@OA0X8krG99ITKTtMlE1AAAAFg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@OA0X8krG99ITKTtMlE1AAAAFg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2020/10/26/finland_psychotherapy_clinic_ransom_attack/

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@OA0X8krG99ITKTtMlE1AAAAFg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[8] https://www.helsinkitimes.fi/finland/finland-news/domestic/22293-prosecutors-vastaamo-s-information-security-was-in-absolute-chaos.html

[9] https://www.theregister.com/2020/10/26/finland_psychotherapy_clinic_ransom_attack/

[10] https://www.theregister.com/2023/02/07/police_exclu_encrypted/

[11] https://www.theregister.com/2023/02/04/microsoft_iran_charlie_hebdo_hack/

[12] https://www.theregister.com/2023/02/03/ubiquiti_dev_guilty/

[13] https://www.hs.fi/kotimaa/art-2000006700041.html

[14] https://krebsonsecurity.com/2022/11/hacker-charged-with-extorting-online-psychotherapy-service/

[15] https://poliisi.fi/en/-/one-person-remanded-in-absentia-for-vastaamo-hacking-incident

[16] https://twitter.com/mikko/status/1320061214647439360?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1320061214647439360%7Ctwgr%5E5ef1bb35afc9f2b1732bdc2c1148b2d2ca80616f%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fwww.theregister.com%2F2020%2F10%2F26%2Ffinland_psychotherapy_clinic_ransom_attack%2F

[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@OA0X8krG99ITKTtMlE1AAAAFg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[18] https://web.archive.org/web/20221103172424/https://eumostwanted.eu/#https://eumostwanted.eu/kivimaki-aleksanteri-tomminpoika

[19] https://whitepapers.theregister.com/