The ex-CEO has denied knowing about the data breach months before it became public.
Ville Tapio was charged. OUTI LAKE
Psykoterapiakeskus Vastaamo’s indictment of the responsible persons is complete. The prosecutor has decided to indict Vastaamo’s former CEO Ville Tapiota against a data protection offence.
The subpoena application has been submitted to the Helsinki District Court. The subpoena application and preliminary investigation material will only become public after the matter has been presented in the district court, unless the district court orders otherwise.
In October 2020, it was revealed that Vastaamo had been the target of two data breaches and that its customer database, such as patient information, had fallen into the wrong hands. The counter had been blackmailed into paying the blackmailer money or else the blackmailer would publish patient information online.
When the extortionist was not paid, he began publishing patient information on darknet websites. Many users managed to download the data partially or completely. The extortionist also approached Vastaamo’s customers by e-mail.
In addition to the data breach, the police have investigated Vastaamo itself. According to the documents released by the court, Vastaamo would have received the first blackmail message related to the data breach already in March 2019, but the company’s former CEO Tapio has denied knowing about the data breach at that stage. Vastaamo filed for bankruptcy in early 2021 due to a data breach.
For example, according to Valvira, Vastaamo is neglecting its obligations based on the provision of private health care.
It is one of the largest criminal gangs in Finnish history. More than 25,000 crime reports have been made, of which there are approximately 22,000 individual crime victims.