The prosecutor demands an unconditional prison sentence of seven years for Aleksanteri Kivimäki, who is accused of the Vastaamo data breach.
On October 18, 2023, charges were brought against Aleksanteri Kivimäki for Vastaamo’s data breach and related crimes.
The prosecutor demands that the imprisoned Kivimäki be punished for serious crimes. The prosecutor demands that Kivimäki be sentenced to seven years’ unconditional imprisonment, and that the instruments of crime be ordered to be forfeited to the state.
The district court exceptionally announced the prosecutor’s subpoena application even before the trial, which is scheduled to begin next week.
Kivimäki, formerly known as Julius, is the only suspect and accused in a large crime complex. Kivimäki has been imprisoned since February.
The prosecutors said at a press conference on Wednesday that they see no need to change the means of coercion and therefore release the suspect from pretrial detention.
Aleksanteri Kivimäki lingered during the detention session in February. Henri Kärkkäinen
Kivimäki is accused of aggravated data breach, attempted aggravated blackmail, 9,598 aggravated dissemination of information infringing private life, 21,316 attempted aggravated blackmail and 20 aggravated blackmail.
There are a total of 21,459 stakeholders.
A serious data breach was committed on November 25–26, 2018, and other crimes in September–October 2020.
Serious data breach
According to the subpoena, Kivimäki has illegally penetrated the information system of Psykoterapikeskus Vastaamo, which provides mental health services, by using a username that does not belong to him or by otherwise breaking the security arrangement.
According to the challenge, Kivimäille has received a patient database downloaded from the vulnerable service.
At the time of the intrusion and download, the patient database contained the highly sensitive personal and patient information of approximately 33,000 patients, as well as patient visit records.
Outrageous extortion and its attempt
According to the prosecutor, between September and October 2020, Kivimäki sent Vastaamo a blackmail message by e-mail, in which he demanded virtual currency from Vastaamo in exchange for 366,000 euros. When the request was not agreed to, 100 patient records were first published on October 21, 2020, and 100 patient records on October 22, 2020.
According to the prosecutor, Kivimäki demanded a payment of 200 or 500 euros from the victims in cryptocurrency, otherwise threatening to publish their patient information. 20 people paid. The prosecutor considers that Kivimäki’s intention was to publish a hundred pieces of information every day, but due to a technical error, it ended up publishing the rest, about 33,000 people’s information at once.