A hacker is trying to blackmail thousands of Finish patients after gaining access to their personal information via a psychotherapy company.
Police have said that an unknown party started demanding ransom from more than 40,000 patients whose data was stolen from the Vastaamo psychotherapy centre, according to local media reports.
The data was taken during a cyber attack in November 2018, and potentially again in March 2019, the Helskinki-based centre said in a statement.
The company is cooperating with the police, but it's reported that some 300 records have already been published on the dark web. It is also being reported that the firm's CEO, Ville Tapio, has been fired for obscuring information about the data breach for more than two years.
The hackers originally sought to extort a ransom from the centre's management but changed tactics over the weekend to elicit payments from individuals that had used the service.
Various patients have spoken to media outlets to say that the hackers have contacted them and threatened to leak mental health records onto the internet unless they provide payment in Bitcoin. Some of the people whose data has been stolen are also underage.
One patient told the BBC that the hacker said Vastaamo had refused to pay 40 Bitcoin (£403,000) and he would now have to pay €200 worth in order to stop his information being released - this included session notes from when he was a teenager.
"I'm anxious about the fact that the attackers are in possession of my notes and conversations from those psychiatrist sessions," he said. "Those notes contain things I'm not ready to share with the world. And having someone threaten me with said notes certainly makes me extremely uncomfortable."
The patient's notes had been taken in a physical notebook and he/she wasn't told these would be uploaded to a server. The country's prime minister Sanna Marin tweeted that the Finish government was looking into ways to support the victims of what he called a "shocking" hack.
