The story of the teenager who became the most wanted cyber criminal in Europe. What a conviction he received for 30,000 crimes

A notorious hacker who was one of Europe’s most wanted criminals has been jailed for blackmailing 33,000 patients by stealing their therapy session records.

The jailing of Julius Kivimäki ends a cybercrime investigation that began 11 years ago, when he was just 13 and ended up in a gang of hackers, the BBC writes.

One of the victims told how the hacker contacted her. She was in a Finnish sauna when she received a message on her phone from an anonymous sender that had her name, social security number and other private details. She said she was surprised at first by how polite the tone was in the message that began with the wording “Dear Ms. Parikka.” However, the sender later wrote to her that he had obtained her private information from a psychotherapy center where she was a patient. Almost apologetically, he wrote that he was contacting her directly because the company was ignoring the fact that personal data had been stolen.

Two years of detailed recordings of discussions with her therapist during dozens of sessions were now in the hands of this man who blackmailed her that if she did not pay a ransom within 24 hours, the information would be posted online. “It was a suffocating feeling,” she says. “I was sitting there in my dressing gown, feeling like someone had invaded my privacy and was trying to make money off the trauma of my life.”

Tiina quickly realized that she was not alone in this situation. The data of a further 33,000 therapy patients was stolen and thousands were blackmailed in what has become known as Finland’s deadliest criminal case.

The database stolen from Vastaamo’s psychotherapy practice contained sensitive information on sensitive subjects, from extramarital affairs to confessions of murder. All had now become a currency of exchange.

Mikko Hyppönen of Finnish cyber security firm WithSecure, which investigated the attack, says the event sent shockwaves through the country and made headlines for days. “A cyber attack of this magnitude is a disaster for Finland – everyone knew someone affected,” he says.

All of this happened in 2020 during pandemic lockdowns, and the case stunned the cybersecurity world.

The impact of the emails was devastating. Attorney Jenni Raiskio represents 2,600 of the victims and said at the trial that her firm had been contacted by people whose relatives took their own lives after patient records were published online.

The blackmailer asked the victims to pay him €200 (£171) within 24 hours and threatened to publish the information if they did not. If this term was not respected, the amount was increased to 500 euros. About 20 people paid up before the victims realized it was already too late. Their information was already published the day before on the darknet.

Mikko and his team tried to help the police, and the hypothesis was that the hacker was probably from Finland.

One of the biggest police investigations in the country’s history has led to a young Finnish man who was a key member of several teenage cyber gangs that wreaked havoc between 2009 and 2015.

At 17 he was arrested and found guilty of 50,700 hacking offences. He received a two-year suspended sentence, a decision that was heavily criticized. After his arrest and before his sentencing, the teenager carried out one of the most daring attacks by a hacking gang, carried out on Christmas Day and targeting the two biggest gaming platforms. Tens of millions of gamers were unable to download games or play them online with their friends.

A hacker who knew him told the BBC that Kivimaki was a spiteful teenager who liked to take revenge on rivals and show off his skills online. “He was very good at what he did and didn’t care about the consequences. He always went further than others in attacks. Despite the attention, he was making bomb threats without even changing his life,” Ryan said.

His name was linked to several minor cyberattacks after his conviction, and nothing was heard of him for years until his name was linked to the attack on patient files at the therapy clinic.

It took the Finnish police nearly two years to gather evidence and notify Interpol that the young man had become one of Europe’s most wanted criminals. But no one knew where the young man who had reached the age of 25 was.

He was found by mistake last February when Paris police went to his apartment after receiving a domestic violence call. They discovered that Kivimäki had false documents. He was quickly extradited to Finland, where police began preparing for one of the most important trials in the country’s history.

Detective Marko Leponen has been leading the case for three years and says it was the biggest of his career. “We had over 200 officers working on this case, the investigation included many victim statements and testimonies.”

Reporters were present at all the terms of the trial. Kivimäki maintained that he was innocent, but the evidence against him was overwhelming.

Detective Leponen said a key piece of evidence was linking Kivimäki’s bank account to the server used to download the stolen data.

In the end, the judges convicted him. According to the court, Kivimäki was guilty of more than 30,000 crimes – one for each victim.

He was sentenced to six years and three months in prison out of a maximum of seven years, but is likely to serve only half due to time already served and the Finnish justice system.

Publisher: GM

Download the Digi24 app and find out the most important news of the day