https://www.bitdefender.com/blog/hotforsecurity/ex-ceo-of-hacked-therapy-clinic-sentenced-for-failing-to-protect-patients-session-notes/ * Company * Blog For HomeFor BusinessFor Partners Consumer Insights Labs Business Insights Industry News 2 min read Ex-CEO of hacked therapy clinic sentenced for failing to protect patients' session notes Graham CLULEY April 20, 2023 Promo Protect all your devices, without slowing them down. Free 30-day trial Ex-CEO of hacked therapy clinic sentenced for failing to protect patients' session notes A Finnish court has given the former CEO of a chain of psychotherapy clinics a suspended jail sentence after failing to adequately protect highly sensitive notes of patients' therapy sessions from falling into the hands of blackmailing hackers. Ville Tapio, the then-CEO of therapy clinic Vastaamo, was unceremoniously fired after a hacker stole the psychotherapy session notes related to tens of thousands of patients, published some of them on the dark web, and demanded a 450,000 Euro ransom. To compound the pressure on innocent victims, the hacker - who went by the name "Ransom Man", then actually emailed patients threatening to release records of their individual psychotherapy sessions if they did not pay him their own Bitcoin ransom. To rub salt into the wound, the hacker bragged about the poor state of Vastaamo's security, saying that the company had used a username/ password combination of "root/root." [brag] A subsequent investigation found that Vastaamo's customer database and sensitive sessions notes had been first breached in November 2018, and then again in mid-March 2019. Despite CEO Ville Tapio knowing about the hack in 2019, he did not inform the authorities or other members of the company's board - and it only became public knowledge 18 months later, leading to Tapio's dismissal. To make matters worse, the company's database of patients' contact details and therapy sessions notes were not properly encrypted, making it easy for extortionists to exploit the information. Unsurprisingly, Vastaamo declared itself bankrupt as a result of the scandal. This week, Helsinki District Court handed Ville Tapio with a three month suspended sentence. The court said that the severity of the crime, and the length of time that the highly sensitive data was not adequately protected from falling into the wrong hands, meant that a "Tapio must receive a prison sentence for the act. However, the court then said that Tapio had no previous criminal record, it would impose a suspended sentence instead. For his part, Tapio has denied committing an offence, and claimed that the responsibility for the breach fell on the shoulders of former members of the company's IT team. In February this year, French authorities revealed that they had arrested 25-year-old Julius "Zeekill" Kivimaki, a self-professed member of the Lizard Squad gang, in connection with the extortion attempt. Finnish authorities had identified Kivimaki as possibly being "Ransom Man" after an examination of the 10GB file of Vastaamo's records uploaded to the dark web was also found to have (presumably accidentally) included the entire contents of the home folder from his PC. Once again, it's clear that you don't have to be a genius to be a cybercriminal. Or a therapy clinic's CEO for that matter. tags Industry News --------------------------------------------------------------------- Author --------------------------------------------------------------------- Graham CLULEY Graham Cluley is an award-winning security blogger, researcher and public speaker. He has been working in the computer security industry since the early 1990s. View all posts --------------------------------------------------------------------- Right now Top posts Threats Industry News Spam trends of the week: Cybercrooks phish for Facebook and Instagram business accounts, Bitdefender Antispam Lab warns April 06, 2023 4 min read Industry News Digital Privacy 'Let's-a go' celebrate Mar10 Day with a big 'Wahoo!' And safe online gaming! March 10, 2023 1 min read Threats Digital Privacy alert Spam trends of the week: Disney+ account phishing and more Turkey-themed charity scams target consumers February 17, 2023 3 min read Industry News alert Threats Threat actors impersonate Canadian gas retailer to deliver malicious OneNote phishing campaign, Bitdefender Labs warns January 26, 2023 2 min read FOLLOW US ON SOCIAL MEDIA --------------------------------------------------------------------- You might also like Industry News Hackers Break into Bluefield University, Hijack Alert System and Leak College President's Info Filip TRUTA May 05, 2023 2 min read Industry News Ukraine Russian Hackers Leverage WinRAR to Unleash Wiper Malware on Ukrainian State Networks Vlad CONSTANTINESCU May 05, 2023 2 min read Industry News City of Dallas Hit by Royal Ransomware - Police Officers Return to Radios, Pen and Paper Filip TRUTA May 04, 2023 2 min read Bookmarks --------------------------------------------------------------------- [ ] (c) 2023 Bitdefender. All Rights Reserved Privacy Settings