Vastaamo Data Breach (2019): What Was Exposed & What To Do

The Vastaamo data breach involved the Finnish psychotherapy service and affected approximately 30,000 individuals. The original security incident occurred between late 2018 and early 2019, with data including email addresses, names, social security numbers and notes from psychotherapy sessions later appearing in breach records. Public reporting on the matter began on March 31, 2019, and the incident has been classified as sensitive, with access to associated records limited to verified owners of the exposed email addresses.

The case is notable because it concerns personal health information held by a mental-health provider. Such records carry elevated privacy expectations under Finnish and European data-protection rules, and their exposure can affect individuals long after the initial event.

Inside the incident

The breach record shows that an initial compromise took place between late 2018 and early 2019. In October 2020 a ransomware operation targeted the company and subsequently contacted patients directly. The dataset associated with the incident contains 30,000 unique email addresses together with names, social security numbers and psychotherapy-session notes. No further technical details on the initial access method or the exact volume of files have been disclosed in the available record.

How a breach like this happens

Incidents affecting healthcare and therapy providers often begin with the exploitation of remote-access services, unpatched systems or stolen credentials. Once inside the network, an attacker may locate file shares or databases that contain client records. In some cases the data are later used for extortion, either by encrypting systems or by threatening to publish the material. The precise sequence in any single case remains unknown unless a forensic report is published.

Vastaamo and its sector

Vastaamo provided psychotherapy services in Finland. Organisations of this type routinely collect and store identifying information, contact details, social security numbers and detailed clinical notes. Because the data describe mental-health treatment, they are subject to stricter confidentiality standards than many other categories of personal information. A breach at such a provider therefore raises questions about both technical security and the handling of especially sensitive records.

The information in question

The breach record lists the following categories of data:

• Email addresses (30,000 unique)
• Names
• Social security numbers
• Personal health data, including notes on psychotherapy sessions

Exact file counts, storage locations and any additional fields remain undisclosed in the public record.

What's at stake

Individuals whose records appear in the dataset face the possibility that their names, contact details and clinical notes could be viewed by unauthorised parties. Social security numbers can be used for identity-related fraud in Finland. The psychotherapy notes, if disclosed, may reveal private medical information that patients shared under an expectation of confidentiality. For the organisation, the incident creates regulatory, reputational and operational consequences typical of healthcare-sector breaches.

What to do if you're exposed

Anyone who believes their information may be involved should first verify whether their email address appears in known breach datasets through a free exposure scan. Practical next steps include monitoring bank and official records for signs of identity misuse, changing passwords on any accounts that reuse the exposed email address, and contacting the relevant Finnish data-protection authority if further advice is required. Organisations holding similar data are expected to notify affected individuals and supervisory bodies when incidents occur.

AICompiled with AI assistance from public sources and published under our editorial standards.