Poliisin ohjeet tietomurron uhreille -EN

Instructions to victims of Vastaamo hacking incident

This page is updated on 31.8.2023.

The Vastaamo hacking case, involving suspected aggravated computer break-in, aggravated attempted extortion and aggravated dissemination of information violating personal privacy, has been under investigation by the police since autumn 2020. The criminal investigation is now completed and referred to the prosecutor for consideration of charges.

You cand find more information about the processing of Vastaamo’s data breach from the webiste of the National Prosecution Authority: Vastaamo | Syyttäjälaitos (syyttajalaitos.fi).

Previous instructions to victims

If your data have leaked on the internet or you have received a ransom message relating to the hacking of Psychotherapy Centre Vastaamo's data, report the crime to the police online. If you are not able to make an online report, you may report the crime at your closest police department during opening hours.

Once you have reported the crime, a statement form will be available for you on police e-services. You may also state your claims in the criminal matter on the statement form. If you have asked the prosecutor to present your claim for damages, the prosecutor will decide whether to do that in connection with the criminal matter if charges are brought.

By completing the form by 31 May 2023, you will make sure that your statement is processed as part of the currently ongoing criminal investigation.

To become an injured party in the criminal proceedings, you must report the crime and complete the electronic statement form. Be careful when making the report and completing the form and provide all the requested information. If you have received a ransom message, keep it as it is and attach it to your statement form.

Reporting a crime

Reporting a crime requires identification as a private person. Please follow the instructions on the form. If you are not able to make an online report, you may report the crime at your closest police department during opening hours.

The points applicable to the offences include 'Other offences' and 'Internet' (place of offence).

You do not have to name the offences yourself, but the offences filled out on the form will be specified as the investigation goes on. The most important thing is that you carefully state all available details on the form.

Any attachments are added to 'Additional information'.

When making the report, remember to mention at least the following:

the word 'Vastaamo'
to whom any ransom message was addressed
if your personal information has leaked, where it has been available (if known)
any ransom demand received and how the ransom should be paid, including the account number
any ransom paid.

Electronic statement form is available at police e-services

In the Vastaamo case, the interviews of victims are mainly conducted online. There is a form available on police e-services for those who have reported a crime in relation to the Vastaamo incident in October 2020. Victims who have reported a crime to the police may make a statement online on police e-services. Those who have not made a report may not be interviewed as victims.

The statement form is available on police e-services for those who have reported a crime in the case. Online reports are recorded in the police system by police departments. This usually takes a few days. You cannot complete the statement form until the police have recorded your report in their system. If the statement form is not available for you within a few days of reporting a crime, contact your local police department.

According to information currently available to the police, around 24,000 victims have reported a crime in the case. The exceptionally large number of victims has been taken into consideration in carrying out the interviews. The electronic statement form has been planned so that it is easy to complete, thus making it as easy as possible for victims to be heard in the matter. The form is located on a secure police platform, and it is safe to fill it in. Victims should complete the form as, in that way, they will remain parties to the criminal proceedings and may subsequently present their claims in the matter.

For data security reasons, the police will not send invitations to victims in person, or any direct links to the statement form. If you receive a message about the statement form sent in the name of the police, or a link to the form, please note that it is not genuine and that the link must not be opened. The police e-services can be accessed at the website poliisi.fi. To access the site, write the address www.poliisi.fi in the browser's address field; do not access the site via search engines.

For advice on how to complete the statement form and for conversational support, please contact Victim Support Finland at its helpline 116 006 or RIKUchat.

I am a victim of the Vastaamo data breach – what should I do to remain a party to the criminal process?

If you have been Vastaamo’s customer and suspect that your personal information has been leaked on the net, or you have received a ransom message, report the crime to the police as soon as possible. Report the crime only if you have not already done so. The current criminal investigation covers the offences of extortion, attempted extortion and related dissemination of information violating personal privacy committed on 23 and 24 October 2020, and victims are asked to file a report of these particular offences.
Once the police have processed your report, a statement form will be available for you on police e-services. Completing the statement form corresponds to your interview as a victim conducted by the police as part of the criminal investigation. You cannot complete the statement form until the police have recorded your report in their system. If the statement form is not available for you within a few days of filing the report, contact your local police department.
Fill in the statement form and attach any necessary documents to it, including any ransom messages received if you have kept a copy of them.
Once you have reported the crime and completed the statement form, you do not need to do anything else at that point. The police will contact you if they need more information for your report or statement.

Please note that the statement form is not available immediately upon filing the report. For this reason, the police urge those who have not yet reported a crime to do so as soon as possible so that they have enough time to complete the statement form by 31 May. Once the statement form is opened on police e-services, it will be accessible for three weeks.

If you have already reported a crime but have not yet completed the statement form, and the form is no longer accessible on police e-services, contact your local police department and they will reopen it for you.

If you are not sure whether you have reported a crime or completed the statement form, contact your local police department.

Contact information for police departments can be found on this site.

Submit tip-offs via net tip

You can report other information about the hacking on an online tip-off form of the police. Please note that the net tip form cannot be used for submitting a report of an offence.

Please also remember that communicating, handling and recording information that has been leaked constitutes a crime.

Advice and emotional support for the criminal procedure

Victim Support Finland (RIKU) has worked with the NBI and supported the victims since information about the hacking was published in the media in October 2020. It continues to provide emotional support, advice and support in the different stages of the criminal procedure, such as in reporting a crime online. Comprehensive advice for victims is also provided on the website of Victim Support Finland.

For practical advice on the criminal procedure or for emotional support, please contact Victim Support Finland's (RIKU) phone line 116 006 or RIKUchat, or submit a request for contact. Before contacting Victim Support Finland, please take time to carefully examine the statement form of the police and the instructions provided at the website riku.fi/en/vastaamo.