Vastaamo Hack: My Darkest Secrets Revealed to the World – A Story of Resilience

The Email That Shattered Privacy: When Personal Secrets Became Public

For Meri-Tuuli Auer, an email seemingly destined for her junk folder instantly shattered her sense of security. It wasn't just ordinary spam; it contained her full name and, more chillingly, her unique Finnish social security number. This was the terrifying prelude to the Vastaamo hack, where personal privacy became a public nightmare, and for Auer, it meant her darkest secrets were revealed to the world.

The message didn't stop there. Alarmingly, it detailed her private psychotherapy sessions with Vastaamo, a Finnish mental health service provider. The sender claimed to have breached Vastaamo’s patient database, demanding €200 in Bitcoin within 24 hours. Failure to comply would escalate the ransom to €500 within 48 hours, threatening to publish her sensitive information – including her name, address, phone number, social security number, and detailed transcripts of her therapy conversations.

“That’s when the fear set in,” recalls Auer, then 30. “I took sick leave from work, closed myself in at home. I didn’t want to leave. I didn’t want people to see me.” She was one of approximately 33,000 Vastaamo patients held to ransom in October 2020 by a nameless, faceless hacker who had accessed their most intimate thoughts – details ranging from suicide attempts and affairs to experiences of child sexual abuse.

Finland's National Crisis: The Vastaamo Data Breach

In Finland, a nation of 5.6 million, the Vastaamo data breach rapidly escalated into a national scandal. Nearly everyone knew someone affected by the theft of therapy records, marking it as the country's most significant crime to date. The then-Prime Minister, Sanna Marin, convened an emergency meeting to address the crisis, but it was already too late to contain the damage.

Before sending extortion emails to individual patients, the hacker had already released the entire stolen database onto the dark web, making untold numbers of private therapy notes accessible for download and continuous circulation. For Auer, this meant the information she had confided to her therapist – personal struggles like binge drinking and a secret relationship – now threatened to become public knowledge, turning her worst fears into reality.

From Vulnerability to Resilience: Meri-Tuuli's Journey

Despite the profound trauma, the Vastaamo hack, surprisingly, revealed a resilience within Auer she never knew she possessed. Her Helsinki flat, adorned with Barbie memorabilia and featuring a pole-dancing pole, projects a vibrant image that belies a lifelong struggle with depression and anxiety.

“I’m outgoing and very confident and I love being around people,” Auer explains, “but I get that inkling that they all think I’m stupid and ugly, and that my life is a continuum of mistakes.” She first sought therapy in 2015, trusting her Vastaamo therapist implicitly with her deepest mental health challenges, her drinking habits, and a secret relationship from her youth. She had no inkling of how these intimate disclosures were documented.

Navigating the Dark Web: The Pain of Discovery

By the time Auer received her ransom email, news of the Vastaamo hack had already broken. Days prior, the extortionist began a drip-feed release of therapy notes – 100 at a time – on the dark web, aiming to pressure Vastaamo into paying a much larger ransom, estimated at £400,000 in Bitcoin.

Auer felt an overwhelming compulsion to search. “I had never used the dark web before. But I was thinking to myself, I just have to see if my records are there.” Though she found her own files absent at first and refrained from viewing others', she witnessed the horrifying reality of strangers mocking patients’ misery. “A 10-year-old child had gone to therapy, and people found it funny.”

When it became clear that virtually every Vastaamo patient’s record had been published, Auer’s mental health deteriorated further. Plagued by uncertainty about who was responsible, or who might have read her most private thoughts, she became terrified to use public transport, leave her home, or even answer the door. The prospect of the hacker facing justice seemed remote.

The Pursuit of Justice: Unmasking the Hacker

Finnish detectives shared Auer’s initial apprehension, daunted by the immense volume of data they needed to process. “I couldn’t even imagine the scale of it. This isn’t a normal case,” stated Marko Lepponen, the lead detective. Yet, after two years of relentless investigation, October 2022 brought a breakthrough: the suspect was named as Julius Kivimäki, a known cybercriminal.

In February 2023, Kivimäki was apprehended in France and extradited to Finland to face charges. With no courtroom large enough to accommodate the 21,000 former Vastaamo patients registered as plaintiffs, public screenings of the trial were arranged in cinemas and other spaces, allowing victims to witness the proceedings.

Auer, determined to see justice served, attended a screening. She was struck by Kivimäki’s ordinary appearance. “He looks just like a regular Finnish young man,” she observed. “It made me feel like it could have been anyone.” His conviction and sentence to six years and seven months in prison brought a sense of validation. “Whatever sentence he was given could never make up for everything. The victims’ suffering was seen by the court – I was thankful for that.” Kivimäki, however, continues to deny responsibility for the Vastaamo hack.

The Enduring Impact and Reclaiming the Narrative

Months after learning of the breach, Auer obtained a hard copy of her records from Vastaamo – a thick stack of papers that serves as a tangible reminder of the trauma. Even years after the initial data release, Vastaamo patients remain vulnerable; a search engine exists on the dark web, allowing users to find leaked records simply by typing a person’s name.

Auer bravely shared excerpts from her leaked therapy notes. “The patient is mostly angry, impulsive, bitter,” she read, quoting her therapist's initial observations. “The patient recounts their past in a rambling manner. There is some interpersonal difficulty stemming from the patient’s weak-tempered nature, typical for their age.” Reading these words for the first time was heartbreaking. “I was hurt by how he had described me. It made me feel sorry for the person I had been.”

The Vastaamo data breach has severely eroded patient trust, with many former clients now unwilling to seek therapy again. The lawyer representing Vastaamo victims in a civil suit against the hacker has cited at least two cases where individuals tragically took their own lives after discovering their therapy notes had been stolen.

Yet, Meri-Tuuli Auer chose to confront her fears directly. She publicly announced on social media that she was a victim of the Vastaamo hack, finding solace in knowing her circle was aware. She openly discussed the contents of her leaked records with her family, including the secret relationship she had never disclosed, receiving immense support. Ultimately, she reclaimed control of her story by publishing a book, tentatively titled 'Everyone Gets to Know'.

“I crafted it into a narrative. At least I can tell my side of the story – the one that’s not visible in the patient records.” Auer has come to terms with the permanence of her exposed secrets. “For my own wellbeing, it’s just better not to think about it.” Her journey is a testament to finding peace and resilience after her darkest secrets were revealed to the world.