Data breach: Medical practice, Finland 2020
A hacker stole the psychotherapy centre’s database with details of around 33'000 patients, including therapy notes.
- Incident · 10.2020 · Finland
- Evidence: confirmed by an authority
- Data breach
As of
What happened
He demanded the equivalent of around 370'000 euros in Bitcoin from the company and, after it refused, wrote to the patients directly with demands of 200 or 500 euros; more than 20'000 people reported extortion attempts. The perpetrator was sentenced in 2024 to more than six years in prison, set at just under seven years on appeal.
- Affected
- Psykoterapiakeskus Vastaamo
- Industry
- Medical practice
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / yes
- Data affected
- true
- Bankruptcy
- unknown
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Proceedings before authorities
Costs of FDPIC or GDPR proceedings, usually not fines
Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Sextortion, ransomware on your own device
Mostly no information 13 of 29 private products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
With health data, a leak affects not only the practice but every single patient; encrypting the database is a must.