Julius 'zeekill' Kivimäki, former Lizard Squad hacker, arrested in France

Julius Kivimäki, the Finnish member of Lizard Squad — who as a teenager in 2015 was convicted on over 50,000 counts of computer crimes — has been arrested again in France.

Finnish police confirmed the arrest on Friday in a press release stating the suspect is being held by French authorities while they "immediately initiate measures to extradite the suspect to Finland."

Finland’s police service had issued a European arrest warrant for Kivimäki, who now goes by the first name Aleksanteri, on charges of computer-related crime and racketeering and extortion.

He was being sought as part of an investigation into a cyberattack targeting Vastaamo, a Helsinki-based private psychotherapy center, that was made public in 2020. As a result of the hack, which began in 2018, sensitive patient data was stolen as well as financial information that was reportedly fraudulently used.

After the institution refused to meet the perpetrator’s extortion demands, individual patients faced demands that they pay up or have documents related to their sensitive therapies exposed online.

Patient records were subsequently posted. The breach of Vastaamo and the industrial-scale extortion against its clients “has deeply shaken Finnish society,” according to a feature-length report about the incident in the Christian Science Monitor, where it was described as “a watershed event for Finland.”

According to an official statement from the Finnish police last October, roughly 22,000 people reported receiving such an extortion attempt. Because of the large number of victims, the police are obtaining victim statements electronically. They had only received about 6,400 statements when the press release was issued.

The stolen documents were subsequently uploaded to the dark web. However, as reported by independent journalist Brian Krebs, the uploaded files also contained a copy of the perpetrator's home folder, which "exposed a number of clues" pointing to Kivimäki.

“The arrest is the result of long-lasting international cooperation and the police's own information acquisition,” said crime commissioner Marko Leponen from the Central Crime Police.

“The schedule of the extradition process depends on many factors, so at this stage it is challenging to estimate when the suspect will be brought to Finland. When the suspect has been handed over to Finland, a new detention hearing must be held in Finland. The goal is to interrogate the suspect as soon as possible.”

Kivimäki, who used the alias "zeekill" in Lizard Squad, has denied the allegations. He wrote on his Twitter account last October, at the time the arrest warrant was issued for him, that he has not participated in criminal activities since he was a teenager and said he deeply regretted those actions.

Lizard Squad was a notorious group of unsophisticated but malicious cybercriminals who were most active in late 2014. The international group was subsequently charged with incidents such as DDoS attacks that took down both PlayStation and Xbox's online gaming services, as well as for bomb threats against a plane carrying Sony Online Entertainment's president, John Smedley.