The Story of Vastaamo

The talk walks through the rise and fall of Vastaamo, a Finnish company founded around 2010 that offered psychotherapy through many local locations and a digital notes and billing system. The presenter, who led the forensic examination of the breached server for an outside firm, frames the story as a tragedy: fast growth and confidence, followed by a sudden reversal once the company's patient data was exposed.

The middle section follows the attacker, who posted extortion demands on Finnish forums and released batches of patient records. After a mistake that packed the attacker's whole home folder into one archive, the full dataset spread across the internet and the extortion lost its leverage. The investigation traced the root cause to a database port left open to the internet with a root account that had no password. Earlier unauthorized access was found, but logging was weak, so timing had to be reconstructed from network flow data and the released records.

The talk then covers the aftermath: the company filed for bankruptcy within about four months, a data protection fine followed, a search site for the stolen records appeared online, and a suspect was later arrested abroad. The presenter argues that regulation at the time did not clearly cover psychotherapy notes and that routine audits never tested for exposed services. The practical takeaway is that sensitive data needs basic exposure checks, logging and backups, because the damage to trust can outlast any technical fix.