Hacker who blackmailed psychotherapy patients sentenced to six years in prison

Aleksanteri Kivimäki, the hacker charged with more than 30,000 counts of attempted extortion after breaching a psychotherapy center, has been sentenced to more than six years in prison, according to local media reports.

Formerly known by the first name Julius and the hacker handle Zeekill, Kivimäki, now 26, was notorious for his previous participation in the adolescent cyber griefing collective Lizard Squad.

On Tuesday, a court in Finland convicted him of all charges relating to the hack of Vastaamo, a Helsinki-based private psychotherapy center, that was made public in 2020 when Kivimäki began to extort individual patients by threatening to publish their stolen information online.

In total he was found guilty of more than 9,200 counts of disseminating information infringing people’s private lives, more than 20,000 counts of attempted blackmail, and 20 counts of blackmail. Kivimäki will independently face more than 5,000 independent claims for compensation related to his crimes.

According to the Helsingin Sanomat newspaper, the district court described the hacker’s crimes as “particularly reprehensible and ruthless.”

The hacker was charged last October, after being extradited to Finland from France. His sentence is marginally shorter than the maximum seven years sought by prosecutors.

Interesting day in Finland. #vastaamo pic.twitter.com/FupGQ9fWWE

— Joe Tidy (@joetidy) January 19, 2024

As a result of the attack on Vastaamo, which began in 2018, sensitive patient data was stolen as well as financial information that was reportedly fraudulently used.

After the institution refused to meet the perpetrator’s extortion demands, individual patients faced demands that they pay up or have documents related to their sensitive therapies exposed online.

Patient records were subsequently posted. The breach of Vastaamo and the industrial-scale extortion against its clients “has deeply shaken Finnish society,” according to a feature-length report about the incident in the Christian Science Monitor, where it was described as “a watershed event for Finland.”

According to an official statement from the Finnish police last October, roughly 22,000 people reported receiving such an extortion attempt. Because of the large number of victims, the police are obtaining victim statements electronically. They had only received about 6,400 statements when the press release was issued.

The stolen documents were subsequently uploaded to the dark web. However, as reported by independent journalist Brian Krebs, the uploaded files also contained a copy of the perpetrator's home folder, which “exposed a number of clues” pointing to Kivimäki.

The Helsingin Sanomat newspaper reported that part of the investigation allowing police to catch Kivimäki was a police payment of 0.1 bitcoin, which they subsequently traced despite a conversion to the “untraceable” cryptocurrency Monero to the suspect.