Vastaamo

Psychotherapy Center Vastaamo, also known as Psykoterapiakeskus Vastaamo or simply Vastaamo, is a Finnish organisation that provides psychotherapy and mental health services to individuals seeking therapeutic support. The centre offers a range of treatment options, including individual counselling, group therapy, and possibly video‑based sessions, aiming to address various psychological conditions and life challenges. As part of its service delivery, Vastaamo maintains detailed clinical records for each patient, which encompass therapy session notes, personal identity numbers, treatment plans, and appointment histories. These records are stored electronically to facilitate care coordination and treatment monitoring within the centre’s operations. The organisation operates primarily within Finland, serving the local population and adhering to national health‑care regulations governing the handling of sensitive personal data. Its core competency lies in delivering confidential psychotherapy while managing the associated administrative and clinical information systems.

In October 2020, Vastaamo experienced a significant ransomware attack that compromised the personal and clinical data of up to 40,000 patients. The threat actor exfiltrated sensitive information such as therapy session notes, personal identity numbers, treatment plans, and appointment histories, while video‑based session records remained secure according to available reports. Following the initial breach, the attacker demanded cryptocurrency payments to prevent the public release of the stolen data and subsequently engaged in direct extortion of individual patients by sending messages that impersonated the centre’s communications. Although the incident was initially believed to involve older records, later indications suggested that more recent patient data may also have been accessed. The exact method of intrusion and the reasons the breach went undetected for a period were not disclosed, leaving unresolved questions about the centre’s security measures and the potential for multiple compromise events. This event highlighted the risks associated with storing extensive mental health records in digital formats and underscored the importance of robust cybersecurity safeguards for healthcare providers.