Vastaamo psychotherapy hack: US citizen charged in latest twist of notorious data breach

The Vastaamo hack was the worst data breach in Finnish history.

Psychotherapy clinic Vastaamo found itself the victim of an extortionist who hacked its systems and stole highly sensitive patient notes.

The hack and the subsequent extortion of both the company and tens of thousands of its patients caused enormous ripples: including the firing and sentencing of the firm's CEO, the company's bankruptcy, and the reported suicide of some patients.

Julius Kivimäki, who years before had been convicted in relation to the Lizard Squad hacking gang's takedown of the PlayStation Network and Xbox Live over the Christmas holidays, was ultimately jailed in 2024 for the breach and the blackmail of Vastaamo and its patients.

But now there have been developments in the case.

Not only has Julius Kivimäki been released for jail, pending an appeal which - if successful - could decide he has spent too long in prison and open the opportunity for him to claim compensation, but also someone new has been charged in relation to the 2018 hack of Vastaamo.

28-year-old Daniel Lee Newhard, an American citizen living in Estonia, has been charged by Finnish prosecutors aiding and abetting the extortion of psychotherapy patients, who received demands for a cryptocurrency payment in exchange for their medical records not being leaked online.

According to reports, IP logs allegedly connected the server to an internet connection in Estonia, and led investigators to the suspect's home address.

Newhard denies the charges against him.