01 / Industry under examination

Vastaamo breach exposed psychotherapy records and triggered extortion of 30,000 patients

      Vastaamo psychotherapy service
      2018–2025
      Surveillance & Privacy
      Archive: verified
      5/5 wildness
    

Intruders accessed Vastaamo’s patient database in November 2018 and retained access through March 2019, exploiting basic security failures including unencrypted, unanonymized records and a root account without a defined password. The Finnish psychotherapy provider disclosed the breach on October 21, 2020, revealing that records for approximately 36,000 patients and 400 employees had been compromised. The stolen data included names, addresses, social security numbers, clinic details, and therapist notes. After Vastaamo rejected a ransom demand of 40 bitcoins—about €450,000 at the time—the attacker published hundreds of records, including accounts involving suicide attempts, adulterous relationships, and pedophilic thoughts.

The attacker then pursued double extortion, emailing roughly 30,000 patients and demanding €200 in Bitcoin, rising to €500 after 24 hours. Vastaamo’s CEO Ville Tapio was removed on October 26, 2020; the company entered bankruptcy in February 2021, and Finland’s Data Protection Authority fined it €608,000 in December 2021 for GDPR violations. Tapio received a three-month suspended sentence in April 2023, but Finland’s Court of Appeal acquitted him in December 2025 for insufficient evidence of gross negligence. Suspect Aleksanteri Kivimäki was arrested in France in February 2023, extradited, and sentenced in April 2024 to six years and three months for the attack and extortion offenses; his conviction was upheld when he was released in September 2025 after extended pretrial detention.

Follow the sources:

Vastaamo data breach - Wikipedia

← Back to Technology Archive

02 / Daily Briefing

Synchronized UTC selection.
Rotates daily across the archive.

Vastaamo breach exposed psychotherapy records and triggered extortion of 30,000 patients

Archive Record · 2018–2025

03 / The Archive

687 stories indexed
Filter by sector or keyword.

Surveillance & Privacy2020s

Wuhan Citizen Journalist Fang Bin Arrested After Documenting Bodies and COVID-19 Information Controls

YouTube, WeChat, Chinese state censorship apparatus, Fang Bin

Fang Bin, a Wuhan businessman and citizen journalist, began recording the COVID-19 outbreak on January 25, 2020, and uploaded videos to YouTube to bypass restrictions on Chinese domestic platforms. On February 1, he published footage showing bodies piled in a minivan outside a Wuhan hospital. According to the source, police arrested him that day, warned him, and released him later that night. Fang continued criticizing official propaganda, the detention of fellow citizen journalist Chen Qiushi, and the treatment of whistleblower physician Li Wenliang. Police reportedly visited Fang’s apartment twice on February 4, and he released his final 12-second video on February 9 with the message “all citizens resist, hand power back to the people.” Fang was then detained and disappeared from public view. Radio Free Asia reported in February 2022 that he might be held at Wuhan’s Jiang’an District Police Station; in May 2023, reports said he had returned home after roughly three years in prison. The case illustrates how China’s information controls, blocked foreign platforms, and police action constrained independent pandemic reporting, although the source does not identify a public court judgment or formal charge.

Archive: verified ↗

Surveillance & Privacy2019–2020

Wuhan authorities questioned doctor after early coronavirus warning in WeChat group

WeChat; Wuhan Red Cross Hospital; Liu Wen

On 30 December 2019 at 19:39, neurologist Liu Wen posted in his Wuhan Red Cross Hospital work WeChat group that a coronavirus-infection pneumonia case had been confirmed at another Wuhan hospital and warned nursing colleagues to avoid the Huanan area. He said he believed the illness might involve person-to-person transmission and urged medical staff to protect themselves. The message was an early internal warning during the first known phase of the COVID-19 outbreak. On 31 December, hospital-related authorities interviewed Liu, demanded his source, and told him not to spread “fabricated rumours”; he documented the encounter in the presence of two police officers. Liu later told Caixin that police summoned him to a station around 2 January 2020, questioned him, prepared written transcripts, and took his fingerprints, although he did not receive the written reprimand issued to Li Wenliang. Caixin reported on 7 February that Liu, Li, and Xie Linka did not know whether they were among eight people publicly identified by police. The source records no subsequent prosecution or formal regulatory finding, but the questioning and fingerprinting became evidence of official pressure on early outbreak warnings.

Archive: verified ↗

Surveillance & Privacy2010s

University of Nottingham Suspended Lecturer After Criticism of Student Terrorism Arrests

University of Nottingham; Rod Thornton; Rizwaan Sabir

In 2011, University of Nottingham lecturer Rod Thornton was suspended after submitting a 112-page paper, “Radicalisation at universities or radicalisation by universities?”, criticizing the institution’s handling of the 2008 arrests of student Rizwaan Sabir and staff member Hicham Yezza. Sabir had been found with academic works from the university library and a digital copy of the Al-Qaeda Training Manual downloaded from a U.S. Department of Justice website. Thornton alleged that senior managers monitored Sabir, influenced his marks, and attempted to justify the police referral through character smears; the university rejected the allegations as containing “clearly defamatory” material. The dispute expanded into claims that students involved in Palestine and Middle East activities were monitored or secretly filmed, and that security staff destroyed a Gaza memorial. These claims were publicly supported by documents released by Support the Whistleblower at Nottingham and Unileaks, an Observer report, and letters signed by 167 staff, students, and alumni and 67 academics, including Noam Chomsky. In March 2012, Thornton left under a mutual agreement and acknowledged inaccuracies in his article. A University of Nottingham inquiry held in June 2014 found that procedures had not been followed in marking Sabir’s MA dissertation; Sabir consequently received the Merit grade he had been denied in 2009.

Archive: verified ↗

Surveillance & Privacy1990s–2000s

MI6’s secret dismissal fight led to an Official Secrets Act conviction and later apology

MI6 and Richard Tomlinson

Former MI6 officer Richard Tomlinson was dismissed on 22 May 1995 after his probation was extended over concerns about his conduct and alleged lack of teamwork. Tomlinson argued that MI6 had mishandled his depression following his girlfriend’s death and trauma from Sarajevo, and that he was denied a fair employment hearing. MI6 obtained a public-interest-immunity certificate from Foreign Secretary Malcolm Rifkind, preventing an employment tribunal from examining the dismissal. In 1998, Parliament’s Intelligence and Security Committee recommended that MI6 be brought under ordinary employment law. Tomlinson was arrested in October 1997 after giving an Australian publisher a seven-page synopsis of his proposed memoir, The Big Breach. He pleaded guilty and received a 12-month sentence on 18 December 1997, serving six months before leaving Britain. The book, published in 2001, included allegations about MI6 operations, some disputed and some later acknowledged in limited form; Tomlinson’s claims that MI6 had planned a strobe-light assassination method were not established as the cause of Princess Diana’s death. In September 2008, MI6 ended its legal opposition to the book, released its royalties, and admitted that earlier actions had been disproportionate. In 2009, it apologised for his treatment and dropped threats of further charges, while refusing reinstatement or compensation.

Archive: verified ↗

Surveillance & Privacy1990s–2000s

Former MI5 officer David Shayler prosecuted after disclosing alleged intelligence abuses

MI5, MI6, and David Shayler

David Shayler, a former MI5 officer who served from October 1991 to October 1996, disclosed classified material to The Mail on Sunday in August 1997. The documents allegedly showed MI5 monitoring left-wing groups and vetting Labour politicians, including Peter Mandelson, Jack Straw, and Harriet Harman. Shayler also alleged that MI6 had funded a 1996 Libyan Islamic Fighting Group operation to assassinate Muammar Gaddafi for £100,000 without Foreign Secretary Malcolm Rifkind’s authorization. According to his account, the bomb struck the wrong vehicle and killed civilians; the source does not independently establish those allegations. After France rejected a British extradition request as politically motivated on 18 November 1998, Shayler returned to the United Kingdom in August 2000. He was charged on 21 September 2000 with three breaches of the Official Secrets Act 1989, including disclosing information derived from a telephone intercept. At trial, Judge Alan Moses ruled that a public-interest defense was unavailable and directed the jury that the disclosures remained criminal; Shayler was convicted and sentenced in November 2002 to six months, serving time at Belmarsh and Ford prisons. The case underscored the limited legal protection for intelligence whistleblowers in Britain, while the underlying MI6 allegations remained contested.

Archive: verified ↗

Surveillance & Privacy1990s–2000s

Former MI5 officer Annie Machon helped expose alleged illegal surveillance and intelligence failures

MI5, Annie Machon, and David Shayler

Annie Machon joined MI5 in 1990 and worked in counter-subversion and Irish-terrorism investigations before resigning in October 1996 with colleague David Shayler. The pair alleged that MI5 maintained secret files on politicians, conducted unlawful telephone taps, misled government overseers, and possessed advance knowledge of attacks including the 1994 bombing of the Israeli Embassy in London. They also alleged British involvement in an attempted assassination of Muammar Gaddafi. These claims were reported by The Mail on Sunday and other outlets, but the supplied source does not establish that every allegation was independently proven; a court injunction restricted reporting on some IRA-related claims. Shayler supplied classified documents to the press, triggering legal proceedings under the Official Secrets Act. After living in hiding and exile, the pair returned to Britain in August 2000; Shayler was convicted and imprisoned for six months in November 2002, while Machon was never charged. The episode demonstrated the legal risks of exposing intelligence operations and kept questions about parliamentary oversight, targeted surveillance, and accountability in public debate. Machon later became a campaigner on privacy and electronic mass surveillance, addressing the European Parliament’s civil-liberties committee in 2013.

Archive: verified ↗

04 / Integration & SDK

Integrate Darkside into your app.

Deploy embeddable web components or consume JSON APIs to power research portals, terminal widgets, and editorial sidebars.

Daily Briefing Web Component

<script src="https://darkside.wiki/daily-technology-widget.js" async></script>
<darkside-daily-technology></darkside-daily-technology>

Custom Embed Options

<script src="https://darkside.wiki/technology-widget.js" async></script>
<darkside-technology-widget data-category="Surveillance & Privacy"></darkside-technology-widget>

REST API Endpoint

GET https://darkside.wiki/api/technology/facts?category=Monopoly+%26+Antitrust&limit=10
GET https://darkside.wiki/api/technology/widget/daily