Patients extorted with sensitive private data: ‘Money made from my trauma’ | RTL News

Tiina Parikka tells the BBC about the moment she was approached by the then anonymous hacker. It was a Saturday evening in 2020 when she received an email in a friendly, almost apologetic tone, explaining that her private information had been stolen at a psychotherapy treatment center. The center had failed to inform her about this, the anonymous sender wrote. He wanted to see 200 euros, otherwise he would reveal two years of very personal conversation reports.

There was no point in paying

“A suffocating feeling,” Parikka describes the first time she saw the email. “Someone tried to make money from my trauma.”

Parikka was not the only victim of ransom_man, as the hacker called himself. The data of a total of 33,000 patients had been disclosed, including children, many thousands of whom received a similar email. At least twenty people paid, but that apparently made no sense. The data had already been spread on the dark web, the hidden part of the internet. They remain there to this day.

It didn’t take long before Julius Kivimäki came into the picture of the police. He had been convicted of computer crime before and was not exactly modest about it. For example, at the end of 2014 he appeared on British national television to talk about the paralysis of both PlayStation Network and Xbox Live. Together with the international hacker collective Lizard Squad, he carried out a DDoS attack on those gaming platforms during Christmas. He was 17 years old at the time.

International wanted list

However, Kivimäki was nowhere to be found by the Finnish authorities. He ended up on Interpol’s international wanted list until he was located last February after two years. Kivimaki lived under a false identity in the French capital Paris.

France extradited him to Finland, where he stood trial this week for digital intrusion into the psychological treatment center. The evidence against him was overwhelming, the BBC writes. He was sentenced to six years and three months in prison.

The Finnish police cannot prove how much money he has earned. Kivimaki claims he has forgotten the details to access his crypto currency.

The hacked treatment center no longer exists and the owner was given a suspended sentence for failing to adequately protect patient data.