Progress made in investigation of Vastaamo hacking incident – police to start to interview victims online

The National Bureau of Investigation (NBI) has investigated the computer break-in against Psychotherapy Centre Vastaamo since autumn 2020. Progress has been made in the criminal investigation, and the next step is to interview victims of the hacking incident online.

As a result of the computer break-in committed against Psychotherapy Centre Vastaamo, sensitive information about Vastaamo's customers ended up on the internet. Some of these customers have received ransom messages in relation to the hacking. The offences investigated by the NBI in the matter comprise an aggravated computer break-in, aggravated extortion, and aggravated dissemination of information violating personal privacy.

– We have made significant progress in the criminal investigation, and we have also followed up interesting leads outside Europe. We have been able to exclude several persons and alternative courses of events during the investigation. Cooperation with local police departments and both national and international authorities has been substantial, says Head of Investigation, Detective Chief Inspector Marko Leponen of the NBI.

The National Bureau of Investigation has also monitored the subsequent use of the hacked data. The crime report database of the police has been followed to find out if personal data obtained from the Vastaamo database have been used in committing other offences, such as identity theft or fraud.

– The monitoring attempts to maintain a situational picture on the possible use of the hacked data for criminal purposes. It also helps in intervening in subsequent criminal use of the data immediately and better preparing for future. No large-scale abuse has been detected in this case, says Marko Leponen.

Electronic statement form will be available at police e-services

The victims will be interviewed mainly online. Today, on 27 October, 2021 at 16:00, an online statement form will be made available at police e-services for those, who have reported a crime in relation to the Vastaamo incident which took place in October 2020. Those victims, who have made a report of an offence to the police, can give a statement online at police e-services by the end of January. Those, who have not made a report, may not be interviewed as victims.

– The number of victims currently known to us is 22,000. We have taken the exceptionally large number of victims into consideration in planning how to carry out their interviews. An electronic statement form has been designed so that it is easy to complete, thus making it as easy as possible for victims to make a statement in the matter. The form is located on a secure police platform, and it is safe to fill it in. Victims should complete the form, because by doing so they remain parties to the criminal procedure and may subsequently present their claims in the matter, says Marko Leponen.

For data security reasons, the police will not send invitations to victims in person or direct links to the statement form. In case you receive a message about the statement form sent in the name of the police, or a link to the form, please note that it is not genuine and that the link must not be opened. The police e-services can be accessed at the website poliisi.fi. To access the site, write the address www.poliisi.fi in the browser's address field; do not access the site via search engines.

Instructions to victims of Vastaamo hacking incident.

For advice on how to complete the statement form and for conversational support, please contact Victim Support Finland at its helpline 116 006 or RIKUchat. Before contacting Victim Support Finland, please take time to carefully examine the statement form of the police and the instructions provided at the website riku.fi/en/vastaamo.