Ransomware Attack Exposes 30,433 Finnish Psychotherapy Records from Vastaamo
What Happened — In October 2020 a ransomware group breached Vastaamo, a Finnish psychotherapy service, and later published a data set containing 30,433 unique email addresses, names, Finnish social‑security numbers and detailed notes from patients’ therapy sessions. The intrusion stemmed from an earlier compromise that began in late 2018‑early 2019.
Why It Matters for Trust & Control Assurance
- Continuous third‑party risk monitoring would have surfaced Vastaamo’s security gaps before the ransomware event.
- Documented incident‑response and data‑protection controls provide the defensible evidence auditors demand after a breach.
- Ongoing evidence collection on vendor controls helps demonstrate due‑diligence across frameworks that map to the same VCF control objective.
Who Is Affected – Mental‑health providers, their patients, and any downstream organizations that rely on Vastaamo’s therapy data (health‑care sector).
Recommended Actions
- Re‑evaluate third‑party risk assessments to include ransomware resilience and data‑protection controls.
- Gather and retain evidence of incident‑response testing, breach‑notification procedures, and vendor security attestations.
- Deploy continuous monitoring tools that automatically collect and validate vendor control evidence.
Source: Have I Been Pwned – Vastaamo breach
Technical Notes – Attack vector: malware‑based ransomware; no public CVE linked to the exploit. Exposed data types: email addresses, full names, Finnish personal‑identification numbers, and psychotherapy session notes. Source: same as above