Serious data breach affects over 100,000 students and employees in Helsinki

The Finnish Data Protection Authority has received only a few inquiries regarding a data breach that occurred on May Day Eve in Helsinki. Clients and employees of the city’s education sector have sought advice to ensure their personal information has not been compromised and to understand what data the city holds about them.

In addition to the Data Protection Authority, the breach is under investigation by the Helsinki Police Department, the National Bureau of Investigation, and the Accident Investigation Board. Authorities are treating the incident as a serious data breach. This breach is reportedly the largest in Finland’s history, with an hacker operating from abroad gaining access to the personal identification numbers and addresses of over 100,000 students and their guardians. Additionally, it affects 38,000 employees of the City of Helsinki. The breach was executed through an outdated remote access server.

A former substitute teacher and educational assistant, who now works in cybersecurity elsewhere, has requested the Data Protection Authority to order the city to provide a comprehensive report about her personal data that is being processed.

The city stated that searching by personal identification number provides “a sufficiently strong assumption that no data will be found,” but acknowledged, “it is still possible that the network drive contains files without personal identification numbers but with other personal data.”

The investigation is ongoing; authorities have not yet determined what specific data has been leaked or made any new discoveries regarding suspects. A separate investigation team has been established to improve societal preparedness for similar incidents in the future.