Two years ago, a cyberattack on a Finnish psychotherapy clinic resulted in data theft and a ransom demand. Now, it is said that the criminals are individually blackmailing patients whose data was stolen in that attack.
The attack on the Vastaamo took place in November 2018 and resulted in the theft of a customer database . However, a second breach is said to have occurred in March 2019. Vastaamo serves thousands of patients in about 20 locations across Finland.
The data breach came to light last month when a blackmailer contacted three Vastaamo employees.
The data that has been exposed includes personal information , as well as information that was discussed in psychotherapy sessions.
According to the Associated Press, the records of 300 Vastaamo patients have been published on the dark web.
Vastaamo said it was cooperating with law enforcement and had advised all patients contacted by the extortionist to go to the police. The clinic described the incident as “a major crisis.”.
The psychotherapy clinic offers a helpline for affected patients, as well as a free session.
According to Finnish media, the country's government held an emergency meeting on Sunday evening. Interior Minister Maria Ohisalodescribed the security incident and subsequent blackmail as "critical."
A Vastaamo patient, who was approached by the blackmailer, stated that he does not believe that paying the ransom guarantees the safety of his data.
The victim said that someone, describing himself as “the ransom guy,” contacted him to demand 200 euros ($236) in Bitcoin. The criminal also said that he contacted him after Vastaamo refused to pay 40 Bitcoin ($515,632).
The blackmailer told the victim that if they did not pay within 24 hours, the ransom would increase to €500 ($590). The deadline was 72 hours. If the money was not paid by then, the blackmailer would publish notes from the victim's psychotherapy sessions as a teenager
“"These notes contain things that I am not ready to share with the world," the victim said. "And having someone threaten me with these notes certainly makes me feel very uncomfortable."“.
Finally, according to InfoSecurity Magazine, the victim said that he cannot afford to pay the ransom, but even if he could pay, he would not be sure of the safety of data .
