Vastaamo data breach

Common card · No. 400267

Vastaamo was a Finnish private psychotherapy service provider founded in 2008. On 21 October 2020, Vastaamo announced that its patient database had been hacked. Private information obtained by the perpetrators was used in an attempt to extort Vastaamo and, later, its clients. The extorters demanded 40 bitcoins, roughly worth 450,000 euros at the time, and threatened to publish the records if the ransom was not paid. To add pressure to their demands, the extorters published hundreds of patient records a day on a Tor message board. After extortion of the company failed, the extorters sent emails to the clients whose data they had obtained, demanding that they pay ransoms in order to avoid publication of their sensitive personal data. These ransom demands were sent to roughly 30,000 victims. The company's security practices were found to be inadequate: the sensitive data was not encrypted and anonymized and the system root did not have a defined password. The patient records were first accessed...

Read on Wikipedia