海角大神

海角大神 / Text

Extortion of therapy patients in Finland shakes culture of privacy

The hack of a private psychotherapy center 鈥 including patient session notes 鈥 has struck the culture of privacy in Finland hard.

By Gordon F. Sander, Correspondent
Helsinki

Katleena Kortesuo wasn鈥檛 completely听unprepared when the extortionist known as 鈥淩ANSOM_MAN鈥 got in touch with her last October.

Two days earlier, it had been reported that hackers had stolen confidential therapy records from Vastaamo, a private psychotherapy center based in Helsinki where Ms. Kortesuo was a patient. RANSOM_MAN 鈥 perhaps the original hacker, perhaps not 鈥 had been sending emails to patients threatening to make their stolen information public if they didn鈥檛 pay the sum demanded, usually 鈧200 ($238).

鈥淭hey knew my name, my email, and my personal identification number [the Finnish equivalent of the U.S. Social Security number],鈥 says Ms. Kortesuo. 鈥淎nd they knew that I had been a patient at Vastaamo.鈥 Even though it wasn鈥檛 a total surprise,she says, it was hard to process the affair 鈥 especially after the hacker backed up his threat by leaking some of the stolen data relating to the victims on the dark net. As of February, some 25,000 criminal reports had been filed in connection with the hack.

鈥淭his was the biggest crime in Finnish history, as well as one of the most horrific,鈥 says Ms. Kortesuo, who is now writing a book about the breach and its societal repercussions.

The Vastaamo hack and subsequent blackmail has deeply shaken Finnish society. While the crime would have been intrusive anywhere, it has struck at some of Finland鈥檚 cornerstone values, including privacy and faith in online connectivity. But it may at least be opening the door to a more public discussion of the importance of mental health and health care.

鈥淭his was definitely a watershed event for Finland,鈥 says Michael Franck, a noted Finnish documentary filmmaker. 鈥淭he fact that this sort of thing could happen here in Finland, a country which prides itself on being one of the cradles of connectivity, as well as one with a strong and secure health-care system, was shocking.鈥

Shaking societal trust

鈥淏reak-ins to computers and stealing databases are unfortunately not so unusual anymore,鈥 says Detective Chief Inspector Marko Leponen of the Finnish National Police. 鈥淪till, if we look at this case, it was basically unprecedented.鈥

Inspector Leponen ought to know. He is the head of the task force that is investigating the case. 鈥淭he amount of personal data that was targeted was just enormous,鈥 he says. Also, he notes that this is the first instance in Finland where ransom was demanded not just from听the breached organization, but from the patients whose data was stolen.

鈥淥ne of the reasons why this hack has been so devastating is trust,鈥 he says. 鈥淲e Finns trust our society and trust that all of our sensitive systems are properly secured.鈥

The fact that the victims were psychotherapy patients, including those with depression and other severe problems, added to the public shock, particularly in a society whose members are not used to discussing their private lives, no less that they or their loved ones are in therapy to begin with.

Psychotherapy isn鈥檛 taboo, says veteran Finnish diplomat Petri Tuomi-Nikula, but talking about it is. 鈥淲e don鈥檛 talk about therapy the way people do in the U.S. In this sense we are more private.鈥

Ami Hasan, a leading Finnish advertising executive, agrees. 鈥淕oing into therapy isn鈥檛 as natural for Finns as it is for Americans,鈥 he says. 鈥淭hen, to have a hacker take advantage of this shyness, or avoidance, or whatever you call it, and tell the patients whose therapy notes he stole, 鈥楶ay me or I will let your employer or loved ones know that you have mental problems.鈥 Well, Finns don鈥檛 take that lightly.鈥

鈥淥f course, breaching the trust and secrecy of what you would tell your therapist would be 鈥 ought to be 鈥 egregious anywhere,鈥 says Teivo Teivainen, professor of world politics at Helsinki University, 鈥渂ut perhaps here it was even a greater shock because the level of societal trust is high.鈥

Dr. Teivainen says that Finns鈥 trust in society is probably due to a combination of factors, including a tradition of relative equality tracing back to Swedish rule, the influence of the once powerful Lutheran Church, and the relative homogeneity of Finnish society.

鈥淰astaamo was a kind of perfect storm for Finns,鈥 says Mark Maher, an American art curator who has lived in Finland for many years. 鈥淚t wreaked havoc with several pillars of the Finnish ethos at once 鈥 their pride in being one of the first digitalized societies, their sense of privacy, and their trust in institutions, both public and private. ... All that was damaged here.鈥

Responding to the hack

The damage and the aftershocks from it have been seen at Victim Support Finland (RIKU), an organization that provides counseling and support to victims of crimes. 鈥淲e have had victims of identity theft,鈥 says RIKU director Leena-Kaisa 脜berg, 鈥渂ut never on this kind of scale.鈥

All told, she says, her agency had more than 22,600 clients in 2020, an increase of nearly 50% from 2019. The Vastaamo hack has been a significant driver behind the increase, she says.

The government is trying to fix the security holes revealed by the hack, says Olli-Poika Parviainen, the state secretary to the Ministry of the Interior. 鈥淭he digitalization of health care and welfare require a high level of security,鈥 he says, 鈥渁nd we are doing our best to ensure that.鈥

However the trauma and gnawing sense of insecurity for the thousands of victims of the blackmail continues, says Ms. Kortesuo, who has been keeping a blog about the case. 鈥淐learly people are suffering from insecurity, hopelessness, anxiety, and powerlessness in this matter.鈥

As an example, she cites one message she received from an anonymous victim. 鈥淭his is a hell that lasts for the rest of my life,鈥 the victim wrote. 鈥淚 might find my data after 4, or 6, or 12 years. My anxiety and stress levels are going through the ceiling.鈥

Still, as traumatic as the affair has been, she says she feels some good has come out of it as well. 鈥淐ompanies鈥 awareness and investment in cybersecurity has risen. I also appreciate the fact that the whole nation supported the victims and condemned the criminals.鈥

Perhaps most important, Ms. Kortesuo says, 鈥渨e learned to discuss mental health as a nation,鈥 pointing to the growing number of people, including health care professionals, who have admitted that they were in therapy too, something which many Finns have been loath to do.

鈥淚n the past one's therapy, or the fact that one was in therapy 鈥 or not 鈥 was not something one discussed here,鈥 says Mr. Tuomi-Nikula. 鈥淏ut that鈥檚 changing fast, at least in part because of this affair.鈥