159: Vastaamo

Joe Tidy investigates what may be the cruelest and most disturbing cyber attack in history. A breach so invasive it blurred the line between digital crime and psychological torture. This story might make your skin crawl. Get more from Joe linktr.ee/joetidy https://linktr.ee/joetidy. Get the book Ctrl + Alt + Chaos: How Teenage Hackers Hijack the Internet https://amzn.to/3He7GNs (https://amzn.to/3He7GNs). https://amzn.to/3He7GNs SponsorsSupport for this show comes from ThreatLocker® https://www.threatlocker.com/. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com https://www.threatlocker.com/. This show is sponsored by Red Canary https://redcanary.com/. Red Canary is a leading provider of Managed Detection and Response (MDR), helping nearly 1,000 organizations detect and stop threats before they cause harm. With a focus on accuracy across identities, endpoints, and cloud, we deliver trusted security operations and a world-class customer experience. Learn more at redcanary.com https://redcanary.com/.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Jack Rhysider?

  So you first came on my radar when I was researching this story. I think it was video game cheats. And I was like trying desperately to find video game, people who are selling video game cheats. And nobody wanted to talk with me on the record. I found a couple of people that were just willing to chat only, but never like audio. And then I found an interview you did with somebody who's just like, "Yeah, I sell video game cheats." And he's like 14 or something. And I'm like, "How did you find this guy?" And so ever since then, I've had just so much respect. And reading this book is, once again, a testament of just how deep you can get into this community and reach these people. And so really, hats off to your ability to infiltrate the hacking world.

• 0:46Speaker 01

  Thank you very much, yeah. It's become something of a speciality. But I mean, really, I'm always surprised they want to talk. But they do. I think there is a thing in hacking, in cybercrime, where as well as the kind of anonymity that it brings, I think people like to brag and they like to show off.

• 1:05Jack Rhysider?

  Yeah, yeah. So I think that leads us right into the first question, which is, "Who are you and what do you do? And how'd you get there?"

• 1:13Speaker 01

  Well, my name's Joe Tidy, and I am the BBC's cyber correspondent. That means I cover hacking, cybersecurity, data protection, online harms, AI, and a bit of crypto as well. And I've been working at the BBC now for about, I think it's seven years in this role. And before that, I was at Sky News. And I was a general correspondent at Sky News, doing all sorts of bits and bobs. But then in 2014, there was this amazingly huge and incredible DDoS attack on Sony PlayStation Network and Xbox Live, which took down those services over Christmas, Christmas Eve and Christmas Day. And it was headline news. And my boss came in and said to me,

• 1:56Speaker 01

  "Right, these gang, these teenagers called Lizard Squad, you've got to find one of them. We want a lizard on air tonight," is the phrase.

• 2:04Jack Rhysider?

  A lizard on air?

• 2:05Speaker 01

  "Get me a lizard on air tonight." Yeah.

• 2:07Jack Rhysider?

  Do they know what kind of ridiculous ask that is? To get a lizard on air tonight? Like on camera even?

• 2:14Speaker 01

  Yeah, exactly, yeah. Not even just a text interview. They wanted them on camera within, I think it was 10 hours when we were going to be on air. And I thought to myself, "Well, this is impossible."

• 2:27Jack Rhysider?

  Joe miraculously pulled it off. He got someone from Blizzard Squad to come on TV and answer questions.

• 2:34Speaker 01

  Speaking to us from Finland, this man who calls himself Ryan says he is one of the hackers. Why? Why did you do this? It affected so many people. It ruined Christmas for potentially millions of people.

• 2:46Speaker 02

  Why we did it? Mostly for to raise awareness, to amuse ourselves. Also, one of the big aspects here was raising awareness regarding the low state of computer security at these companies. Because these companies make tens of millions every month from just their subscriber fees, and that doesn't even include like purchases made by their customers. They should have more than enough funding to be able to protect against these attacks.

• 3:11Speaker 01

  Do you not feel guilty that you've taken so much enjoyment of gaming away from more than 100 million people over this Christmas period?

• 3:20Speaker 02

  I'd be rather worried if those people didn't have anything better to do than play games on their consoles on Christmas Eve and Christmas Day. I mean, I can't really say I feel bad. I might have forced a couple of kids to play, spend their time with their families instead of playing games.

• 3:37Jack Rhysider?

  I can't believe that clip. This kid calling himself Ryan, appearing on Sky News, not hiding his face or voice at all, admitting to taking down Xbox Live and PlayStation. And I just can't believe Joe got that interview. It takes a certain amount of finesse and diligence to get hackers to talk. I should know. But he's got just what it takes to make it happen.

• 4:00Speaker 01

  And he just didn't give a damn. He didn't care. All the, all the chaos that he was causing, all the headlines around the world, people going, what is going on with Xbox and Sony PlayStation? This is absolutely a monumental cybersecurity issue here. And this kid was laughing at the whole thing. And that just made me think, wow, the power that they can wield from keyboard and mouse. And it just really struck me. And from then on, then on out, I was just, yeah, hooked on, on hacking and cyber and have been ever since.

• 4:39Jack Rhysider?

  These are true stories from the dark side of the internet.

• 4:46Jack Rhysider?

  I'm Jack Reisider. This is Darknet Diaries.

• 5:07Jack Rhysider?

  This episode is sponsored by DeleteMe. You care about your privacy, do you? Then get yourself over to joindelete.me.com. And let me tell you why. Whatever size you think your digital footprint is, well, it's bigger. Social media, news apps, shopping, all the private data can be scraped by data brokers and sold. A few years ago, I signed up, and ever since then, they have been busy scouring the internet from my name, and then they give me reports about what they find, and then start deleting stuff. Take control of your data and keep your private life private by signing up for DeleteMe. Now, at a special discount for my listeners, get 20% off your DeleteMe plan when you go to joindelete.me/darknetdiaries and use promo code DD20 at checkout.

• 5:49Jack Rhysider?

  The only way to get 20% off is to go to joindelete.me/darknetdiaries and enter code DD20 at checkout. That's joindelete.me/darknetdiaries code DD20.

• 6:08Jack Rhysider?

  This episode is sponsored by Black Hills Information Security. Black Hills InfoSec loves sharing their knowledge through free webcasts, blogs, zines, comics, and courses designed for beginners and those more advanced. Through their anti-siphon training, they teach you the cybersecurity skills you need, from SOC analyst tools and methodologies to setting traps and running deception operations. It's hands-on, practical training built for people who want to advance and hone their skills. The world of cybersecurity has changed a lot in the last year, and every day seems to bring new questions about what comes next. And that's why Anti-Siphon Training is hosting a free summit on December 9th, asking what in the actual cyber happened in 2026?

• 6:50Jack Rhysider?

  Join experienced practitioners as they share practical lessons, real-world experiences, and insights into the top security news of 2026. And because you're a Darknet Diaries listener, they've got a little something extra waiting for you at blackhillsinfosac.com/darknet.

• 7:06Jack Rhysider?

  Go to blackhillsinfosec.com/darknet.

• 7:14Jack Rhysider?

  The reason why I wanted to talk with Joe Tidy today is because he just published a book called Control, Alt, Chaos, and I just finished reading it. It's great. It starts out in 2020 with a cyber attack in Finland.

• 7:30Speaker 01

  There was this incredibly sinister and cruel cyber attack in Finland, and it shocked the world. And it was, for my money, the worst and most nasty, cruelest, darkest cyber attack in history.

• 7:46Jack Rhysider?

  The worst, most nasty, cruelest, and darkest cyber attack in history? Oh, I'm in. I want to drive straight into that story. But before we hit the gas, let's try to guess at what it could be. What comes to mind when you hear that? Like, maybe a hospital system brought to its knees where lives are on the line? Or maybe a pipeline gets shut down. There's fuel shortages, chaos everywhere. Or maybe an entire government agency gets compromised and state secrets are exposed. Well, those are all serious and probably scary, but they don't sound like the nastiest to me. Let's think smaller,

• 8:24Jack Rhysider?

  closer to home, more personal. Is there something, some piece of data on you that, if exposed, would make you feel fear? Like, a deeply disturbing fear? Maybe it's your photos getting out. You probably just published your photos online anyway, so that's probably not it. Okay, well, what about your text messages? Are those private enough that would cause a lot of fear if they got out? Maybe. Or your location data? Or maybe your password getting leaked?

• 9:01Jack Rhysider?

  Alright, fine. Guessing game is over. Let's hear what it was.

• 9:05Speaker 01

  So the Vastaamo cyber attack was in October 2020. And the first we heard of it was that there was someone on a forum in Finland on the darknet who was saying that they were calling themselves Ransom Man and they were saying, "I have hacked the Vastaamo Psychotherapy Centre. I have got the, all the personal details of all the clients of this ginormous chain of psychotherapy centres." So this is a really well-known company in Finland, a kind of social good company that was very, very popular. They were offering people psychiatrists, psychotherapists, that kind of thing. And they had dozens of centres popping up all over Finland.

• 9:50Speaker 01

  They had a very famous and recognisable logo of a green speech mark. I think Vastaamo translates as "the answer machine" or "the place to go for answers." So in a small country like Finland, everyone knew Vastaamo because if you didn't go to it, you knew someone that probably went to it. So when this ransom man popped up on the darknet on a website, which is now gone, but it was called Tori Lauta, and he said, "I have hacked Vastaamo. I've got all of this information. Not only have I got the information from the patients about like name, address, email, phone number, social security number, I've also, crucially and cruelly, got all their therapy notes as well."

• 10:32Speaker 01

  So that's 33,000 people who were potentially going to have their deepest, darkest secrets exposed online.

• 10:41Jack Rhysider?

  There it is. The notes your therapist took when you spilled your most personal and private thoughts to them. That, in my opinion, is in fact the cruelest piece of personal data that someone could hold for ransom. Especially because you didn't do anything wrong. You were just talking to your therapist. But this ransom man guy was talking with Vastaamo, telling them, "Hey, I hacked your company, I stole your patient records, and all I want is Bitcoin, or else I'm gonna release it to the world." Vastaamo contacted the police, who took over communication directly with this hacker, and they were trying to get as much information as they could from this guy.

• 11:24Jack Rhysider?

  But that went on for six weeks. And RansomMan felt like it wasn't going anywhere and needed to up the pressure to show that he's serious.

• 11:34Speaker 01

  And RansomMan said, "I have been trying to get 400,000 euros," which I forget how many bitcoins it was at the time, but that's how much it equated to. "I've been trying to get that off the CEO of Vastaamo, and the company's refusing to pay. So now I'm going to release 100 records every day until they pay me."

• 11:56Jack Rhysider?

  Of course, the Finnish police were already very aware of this situation because they were working with Vastaamo to try to catch this guy. So they noticed this post right away and start archiving anything, looking for clues. And yes, the first day, he did release 100 records. Everyone's worst fears were a reality.

• 12:17Speaker 01

  It's the kind of stuff that is a nightmare for people who are vulnerable. They're struggling already with their mental health. And then to have this kind of information out there, it's anything you can imagine. So we know now that RansomMan took a lot of time choosing which 100 to release. He wanted the most salacious ones he could find. He wanted the most harmful ones he could find. So he did searches for things like rape fantasies, child abuse. Police as well, at one stage, he was searching for that kind of keywords in the database. And he posted these, these first 100.

• 12:53Jack Rhysider?

  Now typically, when you see someone post a snippet of breach data to a darknet forum saying, "You hacked into something," people think it's funny and maybe even cheer for you. But he didn't see any of those kind of reactions.

• 13:05Speaker 01

  He chose sites that you'd think that would be acceptable to this kind of crime and this kind of maverick approach to morals, I suppose you could put it that way. As well as posting on Turi Lauta, he posted it to a clear web forum called Yolauta, which was known as, like Turi Lauta, known for being a place a bit like 4chan, you know, that horrible website 4chan, where anything goes and edgelords rule and the more offensive you can be, the better. And the two places, those two places that he posted... What I was really surprised at, looking back through the logs in research for the book, was just how much hatred he got straight away.

• 13:51Speaker 01

  There was no respect for him. There was no, "Wow, well done, you've done a crazy thing, awesome." Everyone was very, very angry. There wasn't much love at all for Ransom Man. And what I found really interesting is if you look through the back and forth that he has over the hours that he's on both those websites. People are saying, "You're a script kitty. Go and kill yourself. There's a special place in hell for you." All these things being thrown at him. And quite quickly, his posts got marked as being a sign of criminality on the Yalauta website. So they took it down. But on the Darknet one, it stayed there. And he carried on, he carried through with his threats.

• 14:36Speaker 01

  Every day, he posted 100 more records.

• 14:45Jack Rhysider?

  I mean, I think this might even be an instance where I'd call him a script kitty myself. Normally, I would never call anybody that except maybe myself. Because the term is usually derogatory. Script kitty is just a beginner hacker who doesn't know what he's doing. But I like beginners. We all have to start somewhere. Beginners aren't a problem. But the reason why I might call this guy a script kitty is more because of the "you don't know what you're doing" part. Holding this kind of sensitive data hostage? Dude, that's messed up. You can't mess around with that kind of data like that. This whole thing just strikes me as being so reckless and careless for other people's most inner private details getting out.

• 15:26Jack Rhysider?

  He's got an unbelievable amount of highly personal data and he's weaponizing it in order to profit from it? It's like he doesn't care how much people he hurts from this just so he can try to extort this company. It does seem like he's really grasping for something here. What, fame, money, respect?

• 15:45Jack Rhysider?

  But he's just not getting it from anyone.

• 15:47Speaker 01

  Ransomman even joked about that. He said that getting into this database that was holding all this really private data was really easy. He said there was no password. It was root root. And he put that on the forum and people kind of laughed along with it in a sense. But then there was also the idea that he was out of his depth. People were accusing him, Ransomman, of being an amateur, of not knowing the difference between profit gross, profit net, accusing him of asking the company for too much money. And what's funny about the exchanges on the forum is that he's constantly having to defend his actions as a hacker. He's saying like, no, no, no, I've done loads of hacks and this is just one of them. And I know what I'm doing. And trust me, I'm a serious cyber

• 16:32Speaker 01

  criminal. But people weren't really buying it. But what was also quite troubling and scary is that there were a couple of people, whilst most people on the forum were having a laugh with it and trying to make him feel bad for what he's done, some of them were posting saying, hang on a minute, this is my data. Please, please don't post it.

• 16:54Jack Rhysider?

  So that was the first day. Already it stirred up some people pretty bad. But Ransomman promised another 100 more every day.

• 17:03Speaker 01

  And then like clockwork the next day, another 100. And then like clockwork the next day, another 100. And obviously, as you can imagine, it was getting picked up now by news organizations around the world. People in Finland were getting extremely worried and concerned about it. And there was nowhere to turn to because Vastaamo was in absolute chaos.

• 17:25Jack Rhysider?

  Vastaamo stayed quiet through all this, partially because they were working with the police to try to catch them, partially because they were speaking directly with Ransomman over email. Their customers were freaking out and they were trying to focus on this catastrophe at hand.

• 17:40Speaker 01

  So 300 different patient records now on the internet for anyone to download. And all you had to do was click on one of the links and then you've got access to all of the data. And in some cases, some of these people would be regular clients and patients of Vastaamo. So they would have maybe a year's worth of therapy notes. And these are kind of like... Typed out by the therapist, and it'll be things like, today we talked about this. They wanted to say this. I think it could be to do with this. So you can, you can imagine what types of information and details there are put in there by the therapist. And if you look at the whole thousands of people that were affected by this,

• 18:21Speaker 01

  some of them were regular Vastaamo patients, so they would have, would have had a huge amount of detail. Some of them were infrequent and some of them were, you know, only one or two visits. But the first 300 people that had their notes exposed, they were chosen specifically because they were the most deep and upsetting. And I think, you know, we know now that he knew exactly what he was doing when he chose those.

• 18:42Jack Rhysider?

  Gosh, how awful to be one of those people who trusted this company with their innermost secrets, only to have it all posted publicly for anyone to see. That would absolutely rattle me to my core. I would simply be frozen for a solid week, unable to move, not knowing how my friends or family or coworkers will react if they read it. And I guess this is another lesson in protecting your own data. Just because something is supposed to be safe and secure, doesn't mean it is. Companies might say they treat your data with the utmost privacy, but actually, they don't do as good of a job as they should.

• 19:23Jack Rhysider?

  And it's just one of those reminders that you are the only one who will treat your data with the privacy it deserves. So make sure you're doing it.

• 19:33Speaker 01

  But what he did next was, he made probably the biggest mistake in the history of cybercrime, because he thought, I'm gonna be helpful here. So he told the forum users, here's a, a large folder. You can download the whole, the whole thing, instead of having to go to 123, download links, here, here it all is. But what he accidentally did was posted his entire home directory.

• 19:59Speaker 01

  And the entire list and all the data from the 33,000 patients. So in that one upload, he gave away all his bargaining chips.

• 20:09Jack Rhysider?

  He posted it late at night and went to sleep before realizing his mistake. Of course, by this point, a lot of cybersecurity researchers were keeping a close eye on him, including the police. And when they saw this post, they all immediately tried grabbing this tar folder with all the data. But since he posted it on the darknet on Tor, it was an extremely slow connection. So nobody could really grab it. There just wasn't enough bandwidth and everyone was getting extremely slow download speeds.

• 20:40Speaker 01

  There was a couple of people on the forum in the morning who were talking about, oh, I got five megabytes here, one megabyte here. But this file was 10 gigs big. So, you know, and the kind of the slowest internet speeds that you get on the darknet meant that people weren't able to download the full thing. Plus, there was a little bit of luck that ransom man had as well. He ran out of storage space or something and it kind of it locked out and went down overnight. So it didn't allow many people to have full access to it. But there were some who did, and there were some that managed to get a decent chunk of that file.

• 21:14Jack Rhysider?

  So nobody got the full file. But even just getting the first of five megabytes had a lot of very interesting data in it. People were extracting what they could out of it and looking through it. And it had loads of patient details, but there was some other stuff in there, details about ransom man himself.

• 21:37Speaker 01

  Well, there's this moment where he wakes up and he realizes his mistake. And he posts on on Tori Lauter, whoopsie, enjoy big tar. And he puts a smiley face.

• 21:52Speaker 01

  Emoticon. What's interesting about that, of course, is that he's playing down what is a serious situation for him. He hasn't just given away his entire bargaining chip. He's given away really, really important information that he wanted to keep secret about himself. So very quickly, it becomes clear to the police that if he knows what's happened, they need to be quick. And they, very quickly, in the early hours of that morning, they started tearing through this two gigabyte file that they managed to download from the big tar. And they found an IP address. A crucial IP address. It was a massive stroke of luck from the police.

• 22:31Speaker 01

  Not only that, bizarrely, the IP address was for a cloud hosting provider in Helsinki, where the investigation was taking place. So they, there was this, I spoke to the head detective, Marco Lepponen, and he said there was this mad race to try and get to the cloud service provider, get that computer off the internet as quickly as possible to stop Ransom Man having any control over it. And he says there was a race against time between Ransom Man himself, he could see the files being deleted somehow. And he said that he had to get two police officers in a car, sirens going right the way across town to try and get to this place. They had another officer on the phone trying to get through to them in the early hours.

• 23:16Speaker 01

  They eventually got through on the phone. They had a guy from the company running through the warehouse, finding the server, unplugging it so that Ransom Man had his connection severed. Ransom Man trying to delete the evidence from his massive server, which had way more than the big tar, of course, that had everything on there. And he was only able to delete a certain amount because they got there just in time and pulled the plug.

• 23:38Jack Rhysider?

  Wow, the police were really on the ball here. I mean, holy cow. See, when you're on Tor, the dark net, IP addresses are hidden. These files could be hosted anywhere in the world and the police would have absolutely no idea where to look to find Ransom Man or where the files are hosted. But this file he posted pointed exactly to where those files were hosted. It was a big mistake and it gave the police their first huge piece of evidence. With this server seized, they took it back to the police station to analyze it.

• 24:07Speaker 01

  Yeah, they took the server back to their lab in the cyber bureau, the HQ in Helsinki, and they started going into it. And it gave them a wealth of information, not just about that particular hack that took place, but also about the kind of the network and the infrastructure that was being used, what other cloud service, storage providers that the ransom man was using, receipts from certain things, other little nuggets and little breadcrumbs that took them to online accounts which they could, you know, subpoena, Google for, or whoever it was to get information about individuals. It was a treasure trove. It was an absolute, you know, a boon for the police.

• 24:43Jack Rhysider?

  Sounds like ransom man has screwed up way too many times and the cops are closing in on him. What would you do if you were in his situation? Stay with us, we're gonna take a quick break, but I guarantee you, he does something that you would never think to do.

• 25:00Jack Rhysider?

  This episode is sponsored by Arctic Wolf. Everyone is slapping AI-powered on their security tools, but Arctic Wolf took a different approach. Instead of duct taping AI onto the SOC, they rebuilt the SOC around AI and called it the Aurora Super Intelligence Platform. If you ever tried to build your own AI pipeline, you know the pain. Data engineering, model tuning, governance, validation, Aurora removes all of it. You deploy it and instantly inherit the intelligence, guardrails, and operational maturity of one of the world's largest agentic SOC. Under the hood, Aurora is running a fully agentic architecture they call the Swarm of Experts. These agents are battle-tested inside the world's largest commercial SOC and only ship

• 25:42Jack Rhysider?

  when they can outperform human-only workflows. And its integration is seamless as Aurora works within Arctic Wolf's concierge experience, allowing your security team to focus on higher-value strategy and proactive risk reduction. If you want to see what a real trustworthy agent-led SOC looks like, not the marketing slide version, go to arcticwolf.com/darknet. That's arcticwolf.com/darknet.

• 26:10Jack Rhysider?

  So ransom man was toast. All the data he was holding for ransom is now out there. So he's got nothing left to threaten Vestamo with. And if it was me, I'd be like, oh crap. And I'd delete everything on my machine and close it and set it on fire and try to disappear as fast as I could.

• 26:28Speaker 01

  I don't know what goes through his mind, but he sort of thinks, okay, how can I make some money? I've come, I've come this far. I need to make some money out of this. So the next step is really, really nasty. He finds the email addresses, obviously in the stolen data, of as many people of those 33,000 patients as he can find. I think it was something like 27,500 email addresses. And then he emails them, every single person, all in one batch, with their name in the email, personalized to them with their social security numbers. And he says, I've been trying to get Vastaamo to pay me so I don't release your data. They are not paying me, so you're gonna have to pay me now.

• 27:11Jack Rhysider?

  Oh, wow. He contacts every person he can to try to extort the users individually? That is cruel. Like already they're reeling from their deepest secrets being out there. And now he's hitting them when they're down, saying, give me money and I'll delete your data.

• 27:28Speaker 01

  Which is 200 euros worth of Bitcoin. And if they don't pay within 24 hours, it goes up to 500 euros in Bitcoin. Otherwise, their data will be published online.

• 27:41Jack Rhysider?

  And of course, he CC'd the CEO of Vastaamo and their executives. Vastaamo goes into full panic mode at that point. Tons of people started calling in who were just now hearing about this, really worried. Not only were they calling Vastaamo, but floods of people were calling the police too. And honestly, I can't recall a data breach where the hacker tried to extort all the victims whose data was in the breach. Yes, I know that people combed through data breaches looking for targets to hit. And so the people in the data breach are often victims themselves. But to extort them all like this, that is, that's just something new to me.

• 28:16Speaker 01

  Yeah, certainly at this scale, never before seen. And if you speak to some of the security experts who were looking at the time, you know, this is a real nadir in cybercrime. This is the lowest of the low. This is a cybercriminal who did something despicable in the first place, failed in trying to extort the company, and now is going directly into the inboxes of these vulnerable people. And the impact that this had is just awful. I've spoken to probably, I think about 15 of the victims, and you hear some of the stories of the impact it had on them. One of the women that I spoke to said it was, "It felt like digital rape," she said,

• 28:58Speaker 01

  "which really has always struck me as just such a horrible proposition and such a horrible description. But it does bring to life for me what it feels like. You know, having your data stolen, you know, your private data can feel like a burglary," is what some of the victims said. But having this particular type of information stolen, it's just such an invasion.

• 29:29Jack Rhysider?

  Joe spoke to the lawyer of some of these victims, who told him that some people couldn't handle this news, and they chose to end their own life rather than to face the shame of their data getting out there. It was truly an awful, dark, cruel time for these victims.

• 29:50Speaker 01

  Yeah, so at this point, the story went completely stratospheric, as you can imagine, because people started going online, saying, "I've got this email, I'm being ransomed directly." And if the country hadn't been doing much to help people up to this point, suddenly it kind of burst into gear. You had statements from the president and the prime minister. There were meetings held at the highest level of government. Trying to work out what you can do for these people because of course the data's the data's already out there. Although Ransom Man was asking for payment, not many people paid. I think about, we know for a fact about 20 people sent Ransom Man money. But a lot of people were advised and they got the advice, don't pay. It's too late.

• 30:34Speaker 01

  The data's out there. If you pay, you're wasting your money. And that was the advice that was given. But the the police were getting calls from, we're talking, you know, 33,000 people, potentially thousands of people, all on that same night, hit with this same email, the same threats. So that's an instant spike in criminal complaints. Criminal records and reports needed to be filed. They couldn't cope. There was phone lines set up by Verstamo to try and help people. But they were overwhelmed. The police were overwhelmed. They said, please don't call 999 or whatever the equivalent is in Finland with an emergency. You need to go to this specific number. This was all happening during COVID as well. This was October 2020.

• 31:18Speaker 01

  So the country was already, you know, in a state of panic. There's this picture that I dug up for the book from Twitter, which showed the the prime minister and her cabinet sat around a circular table, all socially distanced, all with all with surgical masks on, looking at this big screen with the Verstamo details on it. And that just really hit home to me, you know. This is such a time of already, you know, peril for society. And then suddenly you've got this this ginormous hack, which in a small country like Finland, five and a half million people, as Mikko Hypponen said, you know, everyone knows that someone who was affected by this.

• 31:59Jack Rhysider?

  20 people paid the ransom. That's what, like $6,000 worth of ransom payments that he made from all this? And in total, that's about all he made from this whole thing? Not a very big payday for him compared to how much damage he caused these victims. At this point, the police had been working on this case for almost six weeks and have started to collect some pretty interesting evidence.

• 32:21Speaker 01

  Well, the main detective, Marco Lepen, obviously, he's very, very happy that they managed to secure this server that ransom man was using and running. And he thinks, great, you know, I've managed to get something here that's going to really help us. But then, of course, it all comes crashing down for him when his phone just doesn't stop ringing because of victims who've managed to get hold of his number, who are calling for help. And there's a sort of scene in the book where Marco feels relieved. But then the phone is going and people are calling, saying, what am I going to tell my husband about my affair? What am I gonna, how am I gonna go into the office on Monday if my colleagues find out what I've said about them?

• 33:05Speaker 01

  And it really, really hits him hard and he breaks down and he's crying and he decides to change his phone number and concentrate on the criminal investigation, which is what he does. And he spends the next best part of over a year trying to figure out who ransom man is.

• 33:23Jack Rhysider?

  Over a year, wow.

• 33:24Speaker 01

  Yeah. And slowly, it dawns on him that this kid or this cybercriminal who was famous when he was a kid, infamous, rather, is probably the prime suspect. And the name Julius Kivimaki just keeps coming up.

• 33:43Jack Rhysider?

  Julius Kivimaki? Of course, his name would come up as a person of interest. It was in the back of a lot of people's minds from the beginning that it might be him. And you know what? You already know who that is. Julius Kivimaki is the guy who took down the Xbox and PlayStation Network on Christmas 2014, the guy that Joe interviewed live on Sky News. You heard his voice at the beginning of this episode, the notorious hacker from Lizard Squad. He's from Finland. He's been involved with some pretty high-profile hacks in the past. And he just doesn't seem to care how much trouble he gets in or chaos he causes. Could ransom man be him? Speculators were thinking it, but the investigator, Marco, was finding actual evidence that was pointing to him.

• 34:28Speaker 01

  But he can't find him. He can't find where Julius Kivimaki is to bring him in for an interview. He could be anywhere in the world. Nobody knows where he is. So... Marco does the quite extreme move of putting out an Interpol red notice to try and find out where he is. And I think it was in November 2022 that he put out the red notice, which means that if there is a police force in Europe that comes across anyone that bears the liking of Julius Kivamaki or has any likeness to him in terms of the kind of aliases that he's using, that kind of thing, need to arrest him on sight in order to send him back to Finland. And Marco puts out this red notice and obviously carries on with other cases and things

• 35:13Speaker 01

  and just hopes that somebody somewhere recognizes Kivamaki and brings him in.

• 35:20Jack Rhysider?

  Julius was smart about evading capture. He was in hiding, using fake IDs and in some other country. There was just no trace of him anywhere. But this is when Joe realized he's talked to this hacker before.

• 35:32Speaker 01

  As soon as the name came out, as soon as that he was wanted with the Interpol red notice, the cybersecurity world were like, hang on a minute. This is the same kid, or not kid anymore, but this is the same person that was this notorious cybercriminal when he was a teenager. And I was like, wow, I couldn't believe it because I was trying to keep tabs on this kid. I had a feeling that he would be back after the lizard squad attacks. And then he comes up and does this. And you just think, wow, this goes to show that if you don't catch and deal with some of these cybercriminals, they will just keep coming back for more. It's sort of like an addiction. If you look at the history of people like Kivamaki,

• 36:16Speaker 01

  and in the book we go into great detail about what he did as a teenager, what kind of gangs he was in, the people around him, the culture around him. There is a kind of element of just addiction and power and greed when it comes to these individuals. And once you get a taste for that hacking life. I think it's hard to let go.

• 36:37Jack Rhysider?

  Meanwhile, Vastaamo is still reeling from this attack.

• 36:40Speaker 01

  So if you ask the CEO of Vastaamo and the founder of Vastaamo, Vila Tapio, he would say that the company could have survived if he'd have been allowed to keep operating it and kind of steered the ship through this crisis. But he was dropped very, very quickly as soon as the investigators began poking around.

• 36:57Jack Rhysider?

  When Vastaamo got the ransom note from Ransom Man, they called the police and the police took over the situation. They took over the CEO's email and they were responding to Ransom Man, posing as the CEO. They were advising Vastaamo how to react to everything. And the police weren't trying to save the reputation of the company. They were trying to solve the case of who did it. So they had a totally different priority than maybe the Vastaamo leadership. So the CEO of Vastaamo didn't have control of the ship in the middle of this crisis. The police did.

• 37:27Speaker 01

  Not only had Ransom Man managed to get hold of this data in 2018, someone else, somewhere, we don't know who, we don't know what happened, they got hold of it in 2019 or they had access to it. And there was, there's still a lot of confusion here about whether or not there was a cover up.

• 37:44Speaker 01

  Tapio denies that vociferously. The IT team that he hired have gone dark. They don't, they don't talk, haven't spoken to anybody. So we don't know exactly the nature of that, but the Vastaamo hack, Ransom Man, plus this incident in 2019, it just meant the company was in absolute chaos and crisis and legal problems as well. You can imagine data protection authorities breathing down their necks. They had fines to pay. And then you've just got the fact that there was tens of thousands of people who just could no longer trust the company. And the way they handled it was atrocious. People were turning up at the therapy centers demanding their notes to be handed over. And some of the staff were in tears.

• 38:26Speaker 01

  And it was just utter, utter devastation. And the company collapsed into administration.

• 38:33Jack Rhysider?

  The company collapsed. Wow. It's pretty rare for a company to be damaged so badly from a cyber attack that it can't recover and has to shut down like this. And it's wild to think that your whole business could come to a catastrophic end all because of a hacker.

• 38:53Jack Rhysider?

  But all this does make you wonder, whose fault is it for not securing the customer's data better? And shouldn't they be held responsible?

• 39:01Speaker 01

  Well, Villa Tapio, the CEO, he has been prosecuted for

• 39:05Jack Rhysider?

  Really?

• 39:06Speaker 01

  For failing to protect the data. But he's appealing that, and we don't know what's going to happen with that.

• 39:14Jack Rhysider?

  The CEO blames his IT team for failing to protect the data. And he blames the police for how badly the fallout was handled. He says when he called the NBI, the National Bureau of Investigation, they locked him out of all decision-making, and he didn't even know what was being said in emails using his name. And pretty early in the investigation, the NBI filed a criminal complaint against the CEO, accusing him of a data protection violation, which led the board to remove him as CEO in the middle of this crisis, while people were trying to call 24/7 looking for help. The company was leaderless during all this. And not only was he dismissed as the CEO, but the parent company of Vastaamo also sued him,

• 39:59Jack Rhysider?

  accusing him of failing to protect user data. Villa Tapio, the CEO, was convicted in the District Court of Helsinki for data protection violations under the EU's General Data Protection Regulations. He was sentenced to a three-month suspended prison sentence in April 2023 after being found guilty of not anonymizing or encrypting the personal data processed at Vastaamo. But he doesn't agree with that, and he's actively trying to fight that to clear his name. So it's still yet to be seen where he lands.

• 40:34Jack Rhysider?

  Around that time, someone phones up the Paris police and reports that there's a domestic abuse situation happening. They said, "There's scary noises. Sounds like a scared woman, an angry man. Something's going on. Check it out."

• 40:48Speaker 01

  They get called out to a domestic abuse situation in Paris. In early twenty twenty three and they the police arrive at in the early hours, I think it's something like half past six, seven o'clock in the morning to a very quiet part of Paris in the north, I think it's the northwest. And they approached the door expecting potentially for there to be a serious situation of, you know, potentially a man abusing a girl, a woman. And they knock on the door and eventually a very bleary, tired looking girl answers the door and she's fine.

• 41:26Speaker 01

  And the police go in and they find a six foot three blond haired, green eyed man who's traveling under the name Asam Armit. And they think, hang on a minute, this person doesn't look like they they should be from Romania. So they run some checks and it turns out this isn't a Romanian living in Paris with his girlfriend or wife at the time. This is the wanted cyber criminal Julius Kivamaki.

• 41:57Jack Rhysider?

  So the Vastaamo hack happened in twenty eighteen, but the ransom attempt and public posting of this data didn't happen until two years later in twenty twenty. And now Julius is arrested in twenty twenty three.

• 42:09Speaker 01

  So they very quickly arrest him and drive him to the police station. And then, of course, the call goes into Marco and the team in Finland and they are high fiving around the office, they're screaming for joy because they didn't think that, you know, this this this red notice would be so successful. This was only a few months after they put the they put the call out to other police for help and they had no idea where he was. So suddenly to have this this arrest take place in Paris meant that they they got their guy.

• 42:41Jack Rhysider?

  So he's sent to jail in Helsinki, Finland and has to face a judge there.

• 42:45Speaker 01

  So it takes some. A good few months to get together the evidence that they need to to start the the trial and the trial takes place in in in Finland, just outside Helsinki and it's the biggest biggest criminal case in Finland's history because of the number of victims. And I went along to the first day when Kiva Mackie was in the dock as a, you know, doing his cross examination and it was absolutely ram packed courthouse, as you can imagine. So many people there wanted to know what he would say and how he would sort of get around it. What was interesting as well was there was lots of people watching who were victims in a cinema, in a secret location as well, watching the live feed.

• 43:27Speaker 01

  But during the trial, about halfway through the trial, somehow Kiva Mackie's legal team managed to convince the the judges to let him out on bail because they thought that he wasn't a flight risk. So he was he was released from prison and he was allowed to do what he wanted, as long as he was under certain conditions, like he had to keep his phone on him and go to a police station every couple of days. But just as soon as he was released, the police were like, whoa, whoa, whoa, you cannot let this guy go because he's gonna be, he is a flight risk, he's gonna disappear again. Because don't forget, he's been, he was wanted and there was a manhunt for him previously. Plus, you've got this massive history as well, where he just doesn't seem to give a damn about the police. So low and behold, they say, the judges changed their mind and they say,

• 44:11Speaker 01

  right, come back to prison, please, Kiva Mackie. We don't know where you are, but but come in because you've got to come back to prison. And he just refuses. He just says, he answers the phone saying, no, I'm staying where I am. I'll see you in court, but I'm I'm still, I'm chilling. I'm not, I'm not going to come into the police, I'm not going to come to prison again until the until the court case starts. So you had this absolutely absurd situation where a wanted cybercriminal who was found by accident in Paris, brought to Helsinki, largest criminal case in Finland's history, released on bail, now they want him back and he's saying no, mid-trial. I just think it's incredible because of course, all the cases that I've covered.

• 44:53Speaker 01

  The defendants are always trying to be, you know, as good as possible and try and convince the jury and the judges that they are upstanding members of society and Kiva Mackey just doesn't care. So the police had to start another manhunt to find out where he is and Marco is so angry about this and he's got all the police resources are out there trying to find him and eventually they managed to track Kiva Mackey down because he posts a picture of himself or posts a picture of a hand holding a really expensive champagne bottle and they recognize the room might be something from an Airbnb and they managed to locate the Airbnb he's in and rearrest him.

• 45:31Jack Rhysider?

  Ninety-six hundred counts of aggravated invasion of privacy.

• 45:36Speaker 01

  Yeah.

• 45:36Jack Rhysider?

  Twenty-one thousand attempted aggravated extortion attempts.

• 45:41Speaker 01

  So those are the emails that they know about.

• 45:44Jack Rhysider?

  Yeah, and twenty counts of aggravated blackmail. I mean, this is crazy. Twenty-one thousand aggravated extortion attempts. Like, of all the, I've heard people get, you know, arrested for like seven counts of this, thirteen counts of that, but twenty-one thousand counts, holy mackerel.

• 46:00Speaker 01

  Yeah, and well, that's the kind of preposterous thing about the Finnish justice system because when you look at it, it's outrageous, isn't it? But actually, if you look at the numbers in detail, so the nine thousand two hundred and thirty-one aggravated dissemination of information infringing private life, those are the people that actually filed complaints. So.

• 46:21Jack Rhysider?

  Really? Nine thousand people?

• 46:23Speaker 01

  Yeah.

• 46:23Jack Rhysider?

  It was like, almost like a class action lawsuit with nine thousand complainers.

• 46:27Speaker 01

  Yeah.

• 46:27Jack Rhysider?

  Wow.

• 46:27Speaker 01

  And then the twenty thousand are the emails that they know of. So they were twenty-seven thousand, I think there were some duplicates, and twenty thousand were the ones that they kind of confirmed as being aggravated. And then you've got the twenty aggravated, which is the people that paid.

• 46:43Jack Rhysider?

  Yeah, in the US, we have civil cases, which is like, you know, a user of the site is claiming damage, that the site caused them, you know, reputational damage or whatever. But this is a criminal case where people complained that this particular person, Kiva Mackey, has harmed their life and in ways that I think that's also unusual.

• 47:05Speaker 01

  Yeah, and they're actually thinking of changing the Finnish justice system to cope with this kind of thing. They've never had a court case on this scale where so many individuals go after and accuse one individual of issues, of criminality. So there's discussions in the country about how they're going to cope with something if this happens again, because they, you know, they had to, they're still working through it, to be honest. They are still working through the backlog of potential compensation to be paid. The company, Verstamo, is bankrupt, so they can't really pay very much, but Kiva Mackey has agreed to pay some people, but it's not going to be much. And of course, the kind of, the scale of harm is very different depending on who you are as well.

• 47:49Speaker 01

  So there would be some people, I spoke to one guy who went there twice with his wife to help them with their divorce, and he doesn't feel particularly aggrieved, or, you know, he's not, he's not feeling too invaded by that. But then you've got people who have been there, going there for years, and they poured their hearts out to the therapist, and now they're absolutely terrified. They look in, if someone looks them funny in the street, they're worried that that person's read their notes and they know the deepest, darkest secrets, you know, they're kind of, there is a real difference in how it's affected people.

• 48:21Jack Rhysider?

  Yeah, so it's, I mean, in, in, in the court there, they mention how many other crimes this guy has committed, and how it just goes back for almost a decade that this guy was a cyber thug. And that's, that's where I think there's just so much more to your book, right?

• 48:45Speaker 01

  Yeah, and you mentioned the 30,000 crimes that the court accused him of or convicted him of, but if you go back not that long, Kiva Mackey has a history of cybercrime. He got convicted of 50,000 cybercrimes when he was a teenager because of various things he did. Because this guy was really brought up in a time when teenage cybercrime gangs were absolutely coming to the fore, they were prolific. There's this period of time in the 2010s where you had this conveyor belt of cybercriminal teenage gangs that were one after the other, passing the baton, upping the ante.

• 49:27Speaker 01

  They were worse than each other each time, they tried to outdo each other in terms of the kind of things they could do, get away with, the kind of criminality and cruelty they could be responsible for. I don't know if you remember any of these gangs, but I'll go through some of them. So LOLSEC probably started this whole thing, I don't know if you remember them, 21. And then after that, you had HTP, which Kivamaki was part of and convicted for. He was actually, he was collared when he went to DEFCON in, I think it was 2012, 2013, when he was a teenager. And the police, the FBI managed to get him in a room, in a hotel room, and interrogate him for some of the stuff he was doing.

• 50:08Speaker 01

  And then he was arrested by the Finnish police and spent time in prison. And then eventually, the long, slow way that the justice system works, he was convicted. But of course, in that time, he didn't stop, and he carried on. And then there were other gangs he was part of, like Lizard Squad and Eugene Nazi, ISIS Gang, all these types of gangs just came and went in this period, causing damage as they did so.

• 50:36Jack Rhysider?

  He was convicted of 50,000 cybercrimes in the past? Look, what we've covered in this episode is only the first few chapters of Joe Tidy's book, Control Alt Chaos. You've got to hear what else this guy did. So I encourage you to go get his book and hear the rest of the story. We only covered one of his hacks here, but there are so many more this guy did. And I have a strong feeling that Julius Kivamaki will go down as one of the most notorious hackers in history. And it's really amazing how close Joe was following this whole story, especially in this Vastaamo case. Like, Joe was in the courtroom, watching all this unfold.

• 51:13Speaker 01

  Yeah, I was there on the first day that he gave evidence. And it was packed full of journalists from all over Finland and also international journalists as well. Because, of course, by this time, this was known as the biggest case in Finland's history. And the Vastaamo court case and the Vastaamo case itself was just such a big nasty story. And I went in and it was really interesting because Kivamaki sat there and he had a laptop in front of him. And he was answering all his prepared questions from his lawyer. And he was just not even thinking about it, just kind of like stroking the mouse keypad on the laptop back and forth, back and forth, and smiling while he was talking and cracking little jokes. He seemed really relaxed.

• 51:57Speaker 01

  And of course, when you look at his history, when you look at the amount of cybercrime that he's carried out, the amount of run-ins with the police, convictions, that makes sense to me. You know, this is the kind of world that he operates in. He doesn't seem to have much care for anything.

• 52:15Jack Rhysider?

  Yeah, yeah, it does seem like that. Just what can I do to set the world on fire kind of thing?

• 52:20Speaker 01

  Yeah, I think it is a bit of that. It's one of the really weird things about this whole case is like, I've followed this guy for 10 years, since he was a teenager. And the people that speak to him and know him, he's not a popular hacker. He falls out with people all the time. He did some nasty stuff even before the Vastaamo hack. I would argue that he's probably the most hated hacker in history. Because he didn't give a damn and doesn't give a damn. And people are confused by him, what his morals are. Because he's got the money. Some people said that he just likes to cause damage and likes to cause chaos and enjoys it.

• 53:04Jack Rhysider?

  And April 30, 2024, Julius Kivamaki was sentenced to six years and three months in prison. He's currently sitting in prison right now, serving his time.

• 53:24Jack Rhysider?

  Thank you so much to Joe Tidy for sharing this incredible story with us. You have to hear the rest of the story, though, so go get his book. It's called Control Alt Chaos, and it releases this month. I have to take a moment to just thank my premium subscribers. They are the real heroes to me for supporting this show. It really helps keep it going. I love you so much. Thank you. And if you're not already a premium subscriber and you want kisses from me, visit plus.darknetdiaries.com. And if you sign up, you'll get an ad-free version of the show, plus 11 bonus episodes. This episode was created by me, The Root Canal, Jack Reece Sider. Our editor is The Drop Tables, Tristan Ledger. Mixing done by Proximity Sound, and the intro music is by The Mysterious Breakmaster Cylinder. Of course, I use a password manager. It's called the Dark Web. Have you heard of it? It's got everyone's password on there.

• 54:09Jack Rhysider?

  You can look up mine or anyone else's. It's real easy. This is Darknet Diaries.