Vastaamo 2019 Data Breach
Healthcare provider · Psychotherapy and mental health services · Clinical care provider · Finland
Vastaamo Psychotherapy Provider Breach (Finland, 2019): Therapy Session Notes & Patient SSN Exposed
Finnish psychotherapy services provider.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
50/100
Lower riskHigher risk
Moderate: notable exposure with meaningful misuse potential.
Data Sensitivity i
RestrictedBeing associated with this breach can itself be harmful. Disclosure is limited and presence is not confirmed to unverified parties.
30KRecords
2019Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
SSNSocial Security Number
PHI / MedicalHealth Information
Breach Summary
Vastaamo, a Finnish psychotherapy services provider that was at one point the largest private mental-health provider in Finland, suffered a data breach with two distinct phases. The original intrusion occurred between late 2018 and early 2019, exposing approximately 30,000 patient records from Vastaamo's centralized patient-records database. The breach remained undisclosed for over a year. In October 2020, the attacker launched a ransomware-style extortion campaign, first attempting to extort Vastaamo itself and then turning directly to individual patients, threatening to publish their therapy session notes unless they paid a personal ransom in Bitcoin. The exposed dataset contained approximately 30,000 unique email addresses alongside names, Finnish personal identity codes (the equivalent of Social Security numbers), and verbatim psychotherapy session notes including clinician observations, patient disclosures, and treatment histories. The compromised therapy notes covered sensitive topics typical of psychotherapy including childhood trauma, sexual identity, substance use, family conflict, suicidal ideation, and other deeply private personal disclosures. The attacker, later identified as Finnish national Aleksanteri Kivimäki, posted batches of the data publicly on the dark web after Vastaamo refused to pay the corporate ransom. For affected patients, the Vastaamo breach represented an unusually severe and durable harm profile that went beyond standard identity-fraud risk. Many individuals received personal extortion demands referencing real disclosures from their therapy sessions, and many of those disclosures were ultimately published. Finnish authorities documented at least one patient suicide following the breach. Affected patients faced lasting consequences including marriage and family disruption, employment risk where mental-health stigma applied, and ongoing psychological harm from the exposure of confidential therapy material. Vastaamo entered bankruptcy in early 2021. The attacker Kivimäki was convicted in Finland in 2024 and received a six-year prison sentence on multiple charges including aggravated extortion. The case fundamentally reshaped Finnish data-protection law regarding patient mental-health records and is widely cited as the most consequential mental-health data breach in European history.
Full threat analysis, exploitation vectors, and principal guidance below.
11 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
30K records analyzed
About Vastaamo
Vastaamo (Psykoterapiakeskus Vastaamo Oy) was a private psychotherapy services provider headquartered in Espoo, Finland. Founded in 2008, the company operated a network of psychotherapy clinics across Finland and provided in-person and remote therapy services through a centralized electronic patient-records system. Vastaamo was at one point Finland's largest private mental health services provider, handling tens of thousands of patient relationships including children, adolescents, and adults. As a HIPAA-equivalent provider operating under Finnish health-data regulations, Vastaamo maintained extremely sensitive patient identity, contact, billing, and detailed mental-health treatment records, including verbatim therapy session notes and clinician observations from individual sessions.
Why They Hold Your Data
Psychotherapy providers collect extremely sensitive patient identity, contact, billing, and detailed mental-health treatment records, including notes and therapy-related disclosures.
Recent Developments
The Vastaamo breach is one of the most consequential healthcare data incidents in European history and led to fundamental changes in Finnish data protection law. Vastaamo declared bankruptcy and was liquidated in early 2021, with the parent company unable to recover from the regulatory, civil, and reputational consequences. In 2024, Finnish authorities convicted the attacker, Aleksanteri Kivimäki, on multiple counts including aggravated extortion, aggravated breach of personal data, aggravated dissemination of information violating personal privacy, and additional charges related to extortion of individual Vastaamo patients. Kivimäki received a six-year prison sentence. The Finnish parliament tightened patient-data security requirements following the breach, and the European data-protection community continues to reference Vastaamo as the leading case study in mental-health data breach harm.
Data Points Exposed
4 verified field types
Email Address
Full Name
Health Information High
Social Security Number Critical
Breach Impact
The institutional impact on Vastaamo was effectively terminal. The company entered bankruptcy proceedings and was liquidated. The Finnish Data Protection Ombudsman fined the parent company, and civil claims followed from many of the affected patients. Finnish authorities pursued criminal prosecution of the attacker through to conviction. The reputational impact extended across the Finnish private healthcare sector, raising concerns about whether private-equity-backed mental health providers were investing adequately in cybersecurity. The case has been formally cited in European data protection regulatory updates and has shaped subsequent regulatory expectations for mental-health data security across the EU. The institutional impact also included broader chilling effects on Finnish patients' willingness to seek private mental health care, particularly for sensitive conditions where therapy-note exposure could affect employment or family relationships.
Exploitation & Downstream Threats
• Identity theft and synthetic identity construction using government-issued IDs | • Targeted phishing campaigns using exposed email addresses
Principal Risk Advisory
What this means for a principal
A healthcare-linked breach: exposure ties a named individual to a provider relationship and, where clinical or insurance data is present, to conditions and treatment. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
- Watch for medical-benefit fraud and health-themed phishing that references real provider relationships.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
AK
Threat Actor: Aleksanteri KivimäkiConfidence: High
Motivation: Financial extortion, notoriety
A Finnish hacker also known as ransom_man. He was convicted for the Vastaamo psychotherapy breach and mass extortion of therapy patients.
Protect Yourself
Protect Yourself: Limited Disclosure
Check If You’re Affected: Verification Required
Because being associated with this breach can itself be harmful, we do not confirm whether anyone appears in it to unverified parties. Verify your identity to privately check whether your own data appears in this breach or related indexes.
We will only reveal whether a specific person appears in this breach to that person.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation