Finland’s top court upholds Vastaamo hacker’s prison sentence

Finland’s Supreme Court has rejected an appeal by Aleksanteri Kivimäki, the man convicted in the Vastaamo data breach, meaning his prison sentence is now final, Yle reports.

In late February, the Helsinki Court of Appeal sentenced Kivimäki to six years and 11 months in prison, increasing the six-year-and-three-month term handed down by the District Court of Western Uusimaa in April 2024.

The breach, one of the largest in Finnish criminal history by victim count, involved Kivimäki accessing Vastaamo’s systems, downloading patient records, and publishing the personal data of roughly 33,000 individuals online. He was convicted of aggravated data breach, attempted aggravated extortion, over 9,200 counts of aggravated violation of privacy, nearly 21,000 counts of attempted aggravated extortion, and 20 counts of aggravated extortion.

The crimes came to light in autumn 2020 when Kivimäki began extorting Vastaamo and its clients.

Kivimäki’s defence lawyer, Peter Jaari, told Yle that his client is not currently in prison, though he did not know his exact whereabouts. Jaari speculated Kivimäki may be abroad. Since prosecutors did not demand immediate imprisonment, the Criminal Sanctions Agency will decide when he must serve the remainder of his sentence.

Jaari last had contact with Kivimäki a few weeks ago and said he had informed him of the Supreme Court’s decision on Monday afternoon but had not yet received a response.