A 25-YEAR-OLD Finnish man suspected of hacking into the client database of Psychotherapy Centre Vastaamo was arrested in France on Friday, according to the National Bureau of Investigation (KRP).
KRP on Friday stated that the arrest was made by local police on grounds of an international arrest warrant, adding that it would initiate the extradition process without delay in co-operation with authorities in France.
“The arrest is the outcome of long-running international co-operation and intelligence gathering efforts by the police. As the timetable for the extradition process depends on a number of factors, at this point it is challenging to estimate when the suspect could arrive in Finland,” commented Marko Leponen, the detective chief inspector in charge of the pre-trial investigation at KRP.
“Once the suspect has been extradited to Finland, a new detention hearing will have to be organised in Finland. The objective is to get to interrogate the suspect as soon as possible.”
The District Court of Helsinki in October detained the man in absentia for probable cause of attempted aggravated extortion, aggravated computer break-in and aggravated dissemination of information violating personal privacy in connection with the hacking.
Psychotherapy Centre Vastaamo’s client database was infiltrated twice, first in November 2018 and then in March 2019. The service provider apparently did not become aware of the breaches until it received a blackmail message in September 2020, a message it reported to KRP, the Data Security Ombudsman, the National Cyber Security Centre and the National Supervisory Authority for Welfare and Health (Valvira).
A swathe of client information was released on the dark net in October 2020, with the blackmailer claiming they were in possession of information on tens of thousands of people and demanding a payment of roughly 450,000 euros in Bitcoin.
Ville Tapio, the founder and chief executive of Vastaamo, was relieved of his duties at the end of the month over a suspicion that he had been aware of but neglected to report the breaches for more than 18 months. Tapio and his parents had sold a majority stake in the service provider to Intera Partners in mid-2019.
The private equity firm initiated civil proceedings over the acquisition, saying it would not have carried out the acquisition had it known about the data breaches. Tapio and his parents subsequently had almost 10 million euros worth of assets seized by the District Court of Helsinki.
Vastaamo was declared bankrupt by the court in February 2021.
KRP has received around 23,000 criminal reports in connection with the incident.
Aleksi Teivainen – HT
