Thousands of Vastaamo leak victims seek higher compensation amid ongoing legal battle

In an unprecedented data breach, victims of the Vastaamo psychotherapy center called for higher compensation after the State Treasury of Finland announced initial damage estimates. Legal experts and victim advocates argue that the amounts proposed—ranging between 500 to 1,500 euros—are insufficient given the severe emotional and psychological harm caused by the leak of highly sensitive mental health information.

The 2020 breach, orchestrated by Aleksanteri Kivimäki, involved leaking therapy session transcripts of over 22,000 individuals onto the dark web. The data was used to attempt extortion of both the psychotherapy center and its clients. The breach, considered the largest of its kind in Finland, targeted mental health records, exacerbating the trauma of victims who were already in vulnerable positions. Kivimäki was convicted and sentenced to six years in prison in April 2024 but is appealing the decision, which delays any finality until at least 2026.

Lawyers representing approximately 3,500 victims, Paula Pajula and Jenni Raiskio, have expressed concerns that the current compensation framework does not adequately address the suffering endured. In a particularly tragic revelation, Raiskio shared that some victims had committed suicide following the leak while many others continue to grapple with the emotional toll of the violation.

The lawyers, along with legal scholars Juha Karhu and Mika Viljanen, have argued that the case demands higher compensation due to the uniquely intrusive nature of the crime. Unlike typical data breaches, the Vastaamo leak exposed the most private aspects of patients’ lives, affecting not only the individuals but also their loved ones. The widespread media coverage of the incident has only compounded the trauma for many victims.

A notable ruling from the Helsinki Court of Appeal in 2023 highlights the precedent for higher compensation in such cases. The court awarded 7,000 euros to one victim, acknowledging that the standard compensation guidelines could not account for the breach of confidential patient information and the severe psychological harm it caused.

Despite these efforts, victims must wait for further legal developments, as Kivimäki’s appeal will not be resolved until 2026. In the meantime, the State Treasury is set to begin processing the first batch of compensation claims.