Police drop investigation into USB drive containing personal data found at flea market

Finnish police have closed a preliminary investigation into a USB drive containing the personal and patient data of nearly 200 individuals, after the statute of limitations expired, public broadcaster Yle reports.

The device, discovered at a flea market in Forssa in summer 2025, contained 253 quarantine and isolation decisions from the municipalities of Akaa and Urjala, affecting 198 people. The Pirkanmaa wellbeing services county filed a criminal report over the data breach.

Investigators confirmed the files were saved to the USB drive between November 4, 2020, and March 5, 2021, during the Covid-19 pandemic. The records were later entered into a healthcare case management system, with administrative staff involved in the process.

While authorities identified the individual who signed the documents and saved them to the drive, they were unable to determine how the USB ended up in a computer bag sold at the flea market. Detective Chief Inspector Maijastiina Tammisto of the Central Finland Police told Yle that the two-year statute of limitations for potential data protection offences—and any breach of official duty—expired earlier this month.

The Pirkanmaa wellbeing services county initially reported the incident in January 2026 after the USB’s discovery.