NBI make progress in Vastaamo data hacking probe

Progress has been made in the criminal investigation into the data hacking incidents of Psychotherapy Centre Vastaamo.

The National Bureau of Investigation (NBI) has been investigating into the incidents since autumn 2020 and the next step is to interview victims of the hacking incident online, said the NBI in a press release on Wednesday.

As a result of the computer break-in committed against Vastaamo, sensitive information about Vastaamo's customers ended up on the internet.

Some of these customers have received ransom messages in relation to the hacking. The offences investigated by the NBI in the matter comprise an aggravated computer break-in, aggravated extortion, and aggravated dissemination of information violating personal privacy.

“We have made significant progress in the criminal investigation, and we have also followed up interesting leads outside Europe. We have been able to exclude several persons and alternative courses of events during the investigation. Cooperation with local police departments and both national and international authorities has been substantial, says Head of Investigation,” Detective Chief Inspector of NBI Marko Leponen said.

The NBI has also monitored the subsequent use of the hacked data. The crime report database of the police has been followed to find out if personal data obtained from the Vastaamo database have been used in committing other offences, such as identity theft or fraud.

“The monitoring attempts to maintain a situational picture on the possible use of the hacked data for criminal purposes. It also helps in intervening in subsequent criminal use of the data immediately and better preparing for future. No large-scale abuse has been detected in this case,” said Leponen.

The victims were interviewed mainly online on Wednesday afternoon.

The victims, who have made a report of an offence to the police, can give a statement online at police e-services by the end of January. Those, who have not made a report, may not be interviewed as victims.

“The number of victims currently known to us is 22,000. We have taken the exceptionally large number of victims into consideration in planning how to carry out their interviews. An electronic statement form has been designed so that it is easy to complete, thus making it as easy as possible for victims to make a statement in the matter. The form is located on a secure police platform, and it is safe to fill it in. Victims should complete the form, because by doing so they remain parties to the criminal procedure and may subsequently present their claims in the matter,” Leponen added.

Vastaamo said the first breach of data took place in different phases since November 2018.