Criminal investigation into Vastaamo hacking case to be completed in late summer – police urge victims to fill in statement form

The criminal investigation into the data breach against Psychotherapy Centre Vastaamo and the subsequent leak of sensitive customer data is expected to be completed in the late summer of 2023. The police urge the victims of extortion or dissemination of information violating personal privacy to report the crime to the police and fill in the statement form available on Police e-services by the end of May, unless they have already done so.

The criminal investigation into the suspected offences in the Vastaamo hacking case, namely an aggravated computer break-in, attempted aggravated extortion and aggravated dissemination of information violating personal privacy, is expected to be completed and referred to prosecution late this summer. 

The police urge the victims of extortion and dissemination of information violating personal privacy to report the crime to the police and fill in the statement form available on Police e-services by 31 May 2023. Those who have already made the report and completed the form do not need to do it again.

The victims must report the crime and complete the statement form in order to maintain their status as victims in the criminal process..

I am a victim of the Vastaamo data breach – what do I need to do to remain in the criminal process??

1. If you have been Vastaamo’s customer and you suspect that your personal information has been leaked on the net, or you have received an extortion message related to the Vastaamo data breach, report the crime to the police as soon as possible, unless you have already done so.
   The current investigation only concerns the offences of extortion and attempted extortion committed on 23–24 October 2020 and the subsequent dissemination of information violating personal privacy, so the victims of these offences are asked to report the crime to the police.
2. As soon as the police have processed your report, a statement form will be available for you on Police e-services. Filling in the statement form online corresponds to your interview as a victim conducted as part of the criminal investigation by the police. The statement form cannot be completed until the police have recorded your report of offence, which usually takes a few days. If the form is not available for you on Police e-services a few days after reporting the offence, contact your local police department.  
3. Fill in the statement form online and attach any necessary documents, including the extortion message if you have received one and kept a copy of it. Read more about how to fill in the form at the websites of the Finnish Police and Victim Support Finland. You may also contact Victim Support Finland’s helpline or RIKUChat. Read the written instructions first..
4. Once you have filed the report to the police and filled in the statement form, you do not need to do anything else at that point. The police will contact you if they need more information for the report or statement.  

Victims may also state their claims in the criminal matter on the statement form. If you have asked the prosecutor to present your claim for damages, the prosecutor will decide whether to do that in connection with the criminal matter if charges are brought.

Completing the form by 31 May 2023 will make it possible for the police to include the statement as part of the criminal investigation expected to be completed in late summer.

Please note that the statement form will not open immediately after reporting the crime, so you should file your report as soon as possible to also have enough time to complete the statement form by 31 May. Once the statement form is opened on Police e-services, it will be accessible to you for three weeks.

If you have already reported the crime but have not filled in the statement form, and the form is no longer accessible to you on Police e-services, contact your local police department and they will reopen it for you.

If you are not sure whether you have reported the crime or completed the statement form, contact your local police department.
Contact information of police departments can be found on this site: Find the nearest police

The large number of victims brings new challenges to the criminal investigation process – why do the police not approach victims in person?

The Vastaamo investigation has been exceptional in many ways. Due to an unprecedentedly high number of victims, the police have created new operating models for dealing with the criminal investigation process.

The police have a duty to give victims the opportunity to be heard in the criminal investigation. Due to the large number of victims in the Vastaamo case, the police developed a new method to gather the victims’ claims. A statement form was opened for the victims on Police e-services. Roughly 24,000 victims have already reported a crime to the police in the case, and around 8,600 of them have also filled in the online statement form.  

– This is by far the largest case the police have investigated. For this reason, we have developed new operating models, for example to interview more than 20,000 victims. Our aim has been to conduct the investigation smoothly and ensure that the legal rights of the victims are respected and that all victims are included in the criminal process. We have also sought to reduce the risk of further crimes against the victims, as criminals have made active attempts to exploit the leaked data, says Head of Investigation, Detective Chief Inspector Marko Leponen of the National Bureau of Investigation.

The opportunities of the police to approach the victims have also been limited to some extent by concerns over data security and protection, and by the Supreme Court ruling stating that the police are not allowed to look up the identity of a possible victim in Vastaamo’s database without consent given by the victim on the statement form. For this reason, the police have not been in contact with those victims who have not been active themselves and reported the crime to the police. 

– We have carefully considered safe options to approach those victims who have reported the crime but have not filled in the statement form. So far, we have had to rely heavily on the media to provide the victims with information, says Head of Investigation Leponen.
If necessary, the police can contact the victims by letter or by phone if they need more information. The police will not contact the victims by e-mail.

Criminal investigation is almost complete  

The criminal investigation into the Vastaamo data breach started in autumn 2020 when Vastaamo requested the police to investigate a suspected computer break-in in which the hacker had gained access to sensitive customer data, and the company was threatened with disclosure of the data. Later that autumn, these customer data were leaked on the dark web, and extortion messages were sent to Vastaamo’s customers.

The police suspect a 25-year-old Finnish man of an aggravated computer break-in, aggravated dissemination of information violating personal privacy and attempted aggravated extortion in the case. The suspect is currently held on remand on probable cause. The police arrested the suspect in France in February 2023. He has already been interviewed by the National Bureau of Investigation, and further interviews and the gathering of forensic evidence are still ongoing.

The National Bureau of Investigation has focused in the criminal investigation on the forensic investigation of the computer break-in, whereas the local police across Finland have received and processed the reports of offences and statement forms of the thousands of victims. 

The criminal investigation into the activities of Psychotherapy Centre Vastaamo and the suspected security breaches was already completed earlier. A district court has issued a judgment on the matter.

Victim Support Finland gives advice and support

It is possible that the progress made in the criminal process and the media coverage on the case may stir up negative emotions, and you may feel that it is difficult to deal with practical issues. Victim Support Finland’s helpline 116 006 and RIKUchat can be contacted for support and advice on how to fill in the statement form. Before contacting them, take your time reading the statement form on Police e-services and the instructions at riku.fi

Useful information for the victims

The police held a press conference with the National Prosecution Authority and Victim Support Finland on 26 April 2023. The event focused on how the criminal investigation and court proceedings proceed from the perspective of the victims of the Vastaamo data breach. You can watch the recording of the event on the NBI’s YouTube channel.

• Instructions to victims of Vastaamo hacking incident: https://poliisi.fi/en/instructions-to-victims-of-hacking
• Police helpline: https://poliisi.fi/en/police-customer-service-helpline 
• Telephone: 0295 419 800 (weekdays 8-16.15)
• Data breach support website: https://tietovuotoapu.fi/en
• File a police report: https://poliisi.fi/en/report-a-crime
• Police e-services: https://asiointi.poliisi.fi/
• What to do if your personal data has been leaked online: https://www.riku.fi/en/what-to-do-if-your-personal-data-has-been-leaked-online/
• Victim Support Finland's (RIKU) phone line: https://www.riku.fi/en/services/victim-support-finland-116-006/
• Victim Support Finland 116 006 helpline is open Mon – Fri 9 am – 8 pm in Finnish language and Mon – Fri 12 noon – 2 pm in Swedish language.
• RIKUchat – online service: https://www.riku.fi/en/services/rikuchat-online-service/
• RIKU's Contact request form: https://www.riku.fi/en/contact-information/contact-request/