Hacker accused of breaching Finnish psychotherapy center facing 30,000 counts

Finnish prosecutors have charged a hacker on more than 30,000 counts related to allegedly breaching a Helsinki-based private psychotherapy center.

The charges include attempted extortion and spreading information that violates private life, according to a statement released this week by Finland’s National Prosecution Authority.

Aleksanteri Kivimäki, 26, who was formerly identified as Julius Kivimäki, has denied any wrongdoing. The Finnish national is currently in pretrial detention, awaiting proceedings scheduled to begin in November. If found guilty, he could face a maximum of seven years in prison.

During a press conference on Wednesday, the chief prosecutor in the case, Pasi Vainio, told the Finnish media that Kivimäki's case is one of the most extensive in Finnish criminal history.

Kivimäki allegedly hacked into the Finnish firm Vastaamo, which managed dozens of psychotherapy centers throughout the country, in 2018, stealing the private treatment records of over 33,000 patients. More than 21,000 of them subsequently filed criminal reports.

After stealing the records, Kivimäki allegedly tried to extort more than $380,000 in bitcoin from Vastaamo and sent extortion letters to patients, demanding payments ranging from €200 to €500 (about $211 to $529) in exchange for not releasing their therapy session records. When Vastaamo refused to pay, the hacker posted batches of patient information, including the records of those who were children at the time, on the dark web.

The stolen information was highly sensitive, including patients' social security numbers, phone numbers, and emails, as well as doctors' notes and transcripts of conversations between patients and mental health professionals.

Finnish media previously reported that the upcoming hearing will be “exceptionally large” as up to 500 victims connected to the psychotherapy center hack have expressed their desire to participate.

The district court has ordered that the identity of the individuals involved be kept confidential due to the sensitivity of the issues.

A former member of the hacking group Lizard Squad, Kivimäki was arrested in February in France. Lizard Squad was most active in late 2014 and subsequently charged with incidents such as distributed denial-of-service attacks that took down both PlayStation and Xbox's online gaming services, as well as for bomb threats against a plane carrying Sony Online Entertainment's president.

As a teenager in 2015, Kivimäki was convicted of over 50,000 counts of computer crimes.