28 ms·

Hackers hijack and publish mental health data of hundreds of people

417 points by aaron695 6y ago

aaron695 6y ago
Also reported they are targeting the individuals - "A blackhat hacker has stolen therapy notes and personal identification of supposefly 40 000 people in #finland, tried to blackmail the target organisation @vastaamo and now targets durectly the individuals. Possible the most outrageous blackmailing ever in the country, (1/2)" "and even wider. Finnish police @PoliisiTiedote tells crime reporting system is down, presumably because of the large number of victims reporting their case. (2/2)" https://twitter.com/ropsue/status/1320086169489637378 https://twitter.com/ropsue/status/1320086169489637378
SebaSeba 6y ago
Some current background info: The breach and the extortion emails are at the moment on the front page of all major Finnish news publications. The Finnish government main ministers are discussing on how to handle the potential crisis, since there are possibly 40 000 patients' records leaked and some of the victims are already in a very vulnerable state and might be feeling even more desperate if their traumas will be publicly shared online. It is also known that there are minors among the victims. https://yle.fi/uutiset/osasto/news/psychotherapy_centre_reveals_two_separate_data_breaches_of_sensitive_patient_information/11612453 https://yle.fi/uutiset/osasto/news/psychotherapy_centre_reve...
raverbashing 6y ago
If companies are happy to pay ransoms they can't complain about being extorted for higher fees What is needed is actual investigation and prosecution of cases.
- Nextgrid 6y ago
  What is needed is also liability for those responsible for managing that data, and maybe an argument that certain data shouldn’t be created to begin with? Content of therapy sessions should maybe not have been kept in a digital format to begin with.
- MeinBlutIstBlau 6y ago
  Hello, but why are backups not a thing? It's like the majority of these companies don't even bother with them.
  - raverbashing 6y ago
    Backups would mean nothing in this case
  - nogabebop23 6y ago
    this doesn't appear to be a ransomware attack, just plain old blackmail. Insecure backups would actually make it worse...
ollifi 6y ago
Tool to check if your information has been leaked (based on e-mail) https://www.tietovuodot.fi/ https://www.tietovuodot.fi/
- ThrAwayOb 6y ago
  Who runs this page and why can (or can't) be trusted ?
  - ollifi 6y ago
    It’s supposedly run by private individual identified in the page. It is possible that it is harvesting e-mail addresses, but does not require other info.
hpaavola 6y ago
The person who claimed to be the "hacker" commented on Finnish 4chan-like board (kuvalauta) that the credentials to access the servers were root:root. AFAIK there's no evidence for or against the claim, but if true, I see two quilty parties here.
- michaericalribo 6y ago
  This is a false equivalence, and victim blaming. Using root:root credentials is sloppy and poor dev practices, but that is minuscule compared with extortion and inflicting widespread stress on a vulnerable population. There’s a reason we have laws against both negligent manslaughter and first degree murder, and there’s also a reason why the penalties for the latter are much more severe than for the former.
  - fastball 6y ago
    Nobody said that they were equivalent, just that there are multiple guilty parties. Not guilty of the same thing, but guilty nonetheless. It's not victim blaming because the victims are the patients. The people who were in charge of securing the records and left the creds as root:root are not victims.
    - TeaDrunk 6y ago
      IMO we are using the language of someone who we know to act maliciously on a massive scale (tens of thousands of people, including minors)as if their words can mean anything without corroboration. Frankly I wouldn't believe a rapist saying "but look at what they were wearing" or a serial killer for saying "but they went home alone". Similarly, I don't hold any credence to a black hat saying "but look at how insecure they were".
      - deleted 6y ago
        [deleted]
      - fastball 6y ago
        Again, nobody is blaming the victims. People hired to secure records that then do an exceedingly poor job are not the victims in this situation. Victims == patients. In your analogies of rape/murder, the (almost) equivalent would be if there was a doorman at an apartment building who was supposed to verify the identity of everyone entering the building, but failed to do so, letting the unauthorized perpetrator into the building and thus allowing the victim to be raped/murdered. It was literally his job to prevent such a situation, and he failed. You maintain that he has no responsibility in this matter?
deleted 6y ago
[deleted]
callias 6y ago
I wonder what countries, if any, give the patient the right to have obviously non-critical information deleted from his health records. In Norway, at least, if you talk to a shrink, there's no easy way to have the record of that conversation deleted; you have only to sit and wait for something like this to happen.
mlang23 6y ago
Clearly this information should never have been allowed to be stored digitally. Those to blame are those which neglected to put the necessary precautions in place. Where I come from, if you forget to lock your car, police can collect the key and fine you for your ignorance. Same should apply when health data gets lost. The patients have virtually no control over what happens with their data after someone entered it into a system. So all the mishap which happen need to be blamed on those which run these systems. Not doing so is a pretty blatant attempt of ignoring responsibilities.
- Const-me 6y ago
  > Where I come from, if you forget to lock your car, police can collect the key and fine you for your ignorance. Where I live, people sometimes intentionally leave keys in their unlocked cars, for convenience of people who sharing a parking space.
  - C19is20 6y ago
    My car was open and had keys in...it got stolen and found 20km away. No damage. Several other cars in the street had broken windows and signs of attempted hot-wiring. Cost to me - time. Cost to everyone else... they're all still pretty livid. Even more so that my car was about 15th in a line of 20. If it had have been first - different outcome. YMMV.
    - nogabebop23 6y ago
      not sure I would leave the keys in my unlocked car, but when I lived in a city with a lot more petty crime many people left their doors unlocked and some spare change in the cup holder. Everyday it was gone but no other damage vs. smashed windows for no gain. It pissed me off but others saw it as equivalent to pay for parking
    - mlang23 6y ago
      You were lucky. Dont you think your analysis is a bit egocentrical though? What if there was a major accident during that 20km drive? What if someone was killed with your unlocked car? Is the damage to your property still your only concern?
imposter 6y ago
>The information published could not be more sensitive: it included the patient's name, personal identification number, telephone number, email address and residence address, together with the content of the therapy sessions. That's just pure evil.
- nabla9 6y ago
  It's incredibly cruel. Blackmailers are now sending emails to people in the database directly. People already bad shape are put into huge stress. There can be suicides. According discussion in Finnish reddit /r/suomi, in the released data batch was therapy discussion involving person who struggled with pedophilic impulses. That's a life ruined.
  - tartoran 6y ago
    That is clearly a cruel thing to do to a person who has those impulses but never acted on them and seeking therapy to get rid of them. This will erode trust in therapists and make people think twice about seeking professional help.
    - gonzo41 6y ago
      If that person doesn't kill themselves they very well may, untreated hurt children. It's staggering how massive this is.
INGELRII 6y ago
This issue can be solved with mandatory insurance and compensation structure. For this sensitive private health information compensation should be at least 5 figures per person, no excuses. A data breach involving 10,000 people could cost 100s of millions. Companies would have to take mandatory insurance against massive data leaks. In order to keep insurance fees reasonable, they would have to implement good security. Insurance companies would do audits because they don't want to lose money. They would promote secure data vaults, require hardware authentication devices from their customers in exchange of insuring them. Car manufacturers must be prepared to do massive recalls in case there is a fault in the car. Automotive recall insurance is a big business. Same thing. Regulatory structures protecting consumers.
- OpticalWindows 6y ago
  I think we need to make it at minimum 6 figures per person for adequate protection. Once information is out there is no taking it back. Banks, jobs will use all information against you. Electronic survalence is just another form of "Public HR" sure someone could intentionally post shit online to fuck with these systems but the creators have no remorse for such "people" as they are "degenrate" to try to destroy such "high minded" systems.
  - seibelj 6y ago
    It should be 7 figures. How can we put a price on knowing how often you go to the doctor?
    - baobabKoodaa 6y ago
      Sure, and while we're at it, why don't we make it a gazillion euros. After all, you can't put a price on privacy.
      - contravariant 6y ago
        Actually it should be free, after all you can't put a price on privacy.
chaps 6y ago
Heh, years ago I wanted to see if some mental health info of mine was accessible over the internet of a major university. Nothing fancy, just did a port scan of their IP range. I found that they had dozens of their psychology department's printers accessible over the internet. So, I contacted their office, telling them that PII was likely accessible through these printers (through exploits), and asked that they look into why so many internal machines were accessible over the internet, and to at least remove the printers from the internet. They responded by telling me that there were no internet-accesible printers and that their scans would have detected something like that.. and then asked that I send them any PII. I didn't, but... it truly felt like they were trying to set me up for throwing the blame my way. It's really bad out there.
- unstatusthequo 6y ago
  I would have printed the message using their printers. Maybe that would have been more effective?
  - siberianbear 6y ago
    I think the grandparent comment made the right call. It could have worked out well. Or perhaps the university would have taken disciplinary action against him for "hacking" the university computer system. No good deed goes without punishment.
  - lucb1e 6y ago
    More effective, perhaps, but it's also dancing on the edge of the law. In the Netherlands the public prosecutor doesn't pursue cases of ethical hacking (afaik the other party can still file a civil case if there are damages though, and I would assume reputational damage counts), but they totally made a case against a person that claimed to be white hat but offered to fix the problem for around 20'000 euros. Specifically: > De man nam contact op met de praktijk en meldde dat een kwetsbaarheid toegang bood tot de persoonlijke gegevens van artsen, waaronder e-mailadressen, gebruikersnamen, wachtwoorden en bankrekeningnummers. Vervolgens stuurde hij een offerte met het aanbod om voor 16.500 tot 23.000 euro de kwetsbaarheid te verhelpen. In die offerte stond volgens het OM een 'dreigende mededeling': "Er zal waarschijnlijk een boete betaald moeten worden wanneer dit openbaar is en er zal een flinke reputatieschade plaatsvinden." Het OM schrijft dat de politie na onderzoek constateerde dat op de laptop van de man de gevoelige persoonsgegevens stonden en dat zijn ip-adres te relateren was aan de inbraak. From https://tweakers.net/nieuws/167792/om-eist-twee-maanden-cel-voor-vinden-lek-en-aanbod-dat-voor-geld-te-dichten.html https://tweakers.net/nieuws/167792/om-eist-twee-maanden-cel-... Summary translation: he found an issue in a doctor's office, told them "you'll probably get fined if this becomes public and there will be large reputational damage" and sent an offer for 16.5-23k euros for a fix. The public prosecutor saw the message as threatening (blackmail) and therefore decided this wasn't simply a white hat reporting an issue and offering legitimate services. Upon investigating, sensitive personal data was found on his laptop. So is hacking into their printers to send a message proportional to the issue? I would say yes, but one might also argue this goes beyond what is strictly necessary to prove the issue. (Another guideline is that downloading your own PII to confirm an issue is fine, and that it can also be fine if you accidentally find PII but don't request more than that first record, but nothing beyond that.) You might argue that they didn't listen, but I don't know if that's an argument a judge finds compelling. Different countries can have different systems, not sure how white hat hacking is treated in Iran, the USA, Brazil, or other countries that seem to enjoy putting a lot of citizens behind bars.
danieka 6y ago
IANAL but of you are impacted by this you should seriously consider filing a civil suit against the data controller. The most interesting article of the GDPR for you will be article 82 which entitles you to compensation if you have been materially or immaterially harmed. If your personal information has been leaked this would a clear case of immaterial damage. It has probably caused you anguish and is a violation of your right to privacy. In this case you will have a huge advantage since there is a police investigation which no doubt will provide you with plenty of evidence to use in your civil suit. Once you have proven that your data has been leaked the defendant/data controller has the burden of proof to show that they are in no way responsible for the damage caused to you. As I said, IANAL, but I was personally involved in a similar case in Sweden which did go to trial (and then settled). Hopefully there will be a class action against the data controller. EDIT: Once again IANAL, but if you have questions reach out to me on mail@danielk.se and hopefully I can give you pointers for your research.
- pavlov 6y ago
  The upside is probably very limited. A private psychotherapy provider in Finland doesn’t have millions in their bank account. They’re effectively bankrupted by this news already, as business grinds to a halt. By the time a class action suit awards something to the victims, the company will be long gone.
  - fogihujy 6y ago
    The GDPR fines alone might end up bankrupting them (and rightfully so IMO). The only upside, if any, is that this might serve as a warning to anyone claiming that one doesn't have anything to worry bout if one doesn't have anything to hide.
  - anttisalmela 6y ago
    Class action is very limited in Finland - the law that allows this is quite recent, there has been no class action suits yet at all and I'm not sure if it would be even applicable here.
    - 6y ago
DoofusOfDeath 6y ago
Does anyone know if state intelligence agencies have the capability of hunting down this kind of hacker? I would think that their need to receive ransom money would limit their ability to hide completely.
- beagle3 6y ago
  Likely yes, but at a cost they wouldn’t want to pay, because it will “burn” their ability to do this in cases they likely deem more important, such as those where lives and state security are directly threatened. In the US, the NSA likely has enough data to solve 85% of all unsolved crime, and to prove innocence of 95% wrongly accused; but doing so would limit their future abolity to do so (and the ability to do their actual job) so they won’t.
  - hh3k0 6y ago
    And 42.7% of all statistics are made up on the spot.
    - beagle3 6y ago
      True, I should have added "(statistics that seem right to me that I pulled out of thin air)". That said, Snowden disclosures and others indicate that if there's an email, voice call, location information or any other digital piece of information, it is accessible to the NSA, not warrants required.
notRobot 6y ago
There's a well known phenomenon where if the infosec division of a company is working well, it's not obvious at all to management, because no leaks are taking place. So their budget gets cut. And then the data leaks/breaches happen. Once a leak happens, the infosec division gets free reign for a few years. Until a new manager goes all "you guys don't even do anything!", and the cycle repeats.
- beagle3 6y ago
  Also known as “the bathrooms here are always so clean here, we can fire the janitors!” line of reasoning.
brightball 6y ago
Stuff like this was my biggest concern with the mandates for digital transformation in medical record keeping. The security of a locked file cabinet cannot be understated.
- Hamuko 6y ago
  >The security of a locked file cabinet cannot be understated. It doesn't take much to defeat a file cabinet lock.
  - blackbrokkoli 6y ago
    It does however is quite hard to do it in hundreds of locations, possible undetected, over prolonged time periods without being personally there. "I can always go and stab someone" is not an argument pro autonomous killing drones either.
  - Laakeri 6y ago
    Defeating file cabinet locks in this scale would
Indy9000 6y ago
There's no good reason to have personally identifiable information stored in the system. They could easily issue each patient an alphanumeric ID which is not tied to personal information yet uniquely distinguishable.. This is a system design failure to begin with. Design sensitive systems with only minimum required information. The alternative is to have a massive framework to make sure PII hadn't leaked. And then a legal and financial frameworks on top of that.. after all if a leak happens it can't be undone. Damage to the people will be long standing and cascading. Best is to have a system that have no or minimum PII.
- chrisseaton 6y ago
  > There's no good reason to have personally identifiable information stored in the system. They’re medical records. Seems inherently likely to be PII?
  - Indy9000 6y ago
    Medical records can be stored without personally identifiable information (PII). And they should be. That's what I'm proposing.
    - Hamuko 6y ago
      How do you link a person's medical history to a person without personally identifiable information?
      - Indy9000 6y ago
        Medical history has to be only meaningful between doctor and patient. Doctor can keep records under a unique ID which patient is given at the start of sessions and the patient presents it at each session to validate the relationship. In the event of a breach, even when all data is exposed, without tracking the unique ID back to a person (which would be difficult or impossible) the harm is little.. (Imagine reading a story of a person but you don't know who that person is..) You might say that there would be other person names and places in mentioned in the records and from that network and timeline you may be able to deduce the identity.. but these PII can in turn be depersonalised. And also this is not scalable for widespread damage. It just need a bit of thinking when designing a system. Frankly any org that ask for PII and doesn't have a well thought out way to store them should be heavily penalised. That's what the law should do standardised methods of storing sensitive data.
mtm7 6y ago
This has to be a nightmare for the patients. According to the article, some are already struggling with depression and anxiety. > The information published could not be more sensitive: it included the patient's name, personal identification number, telephone number, email address and residence address, together with the content of the therapy sessions.
JohnCClarke 6y ago
Co-founder of InsurTechnix here. Our tech helps cyber insurers provide pro-active risk mitigation inside of just financial risk transfer. My Mom suffered her whole life from manic depression and schizophrenia so I can imagine what the victims of these attacks are going through. The reason we like cyber insurance as a channel for cyber security is that the insurers have "skin in the game" in because they pay out for incidents.
- robocat 6y ago
  Who do the insurers pay out? If a company indemnifies themselves through insurance, they have increased their moral hazard (ignoring balanced decreases in other areas). Insurance doesn’t help the victims.
  - JohnCClarke 6y ago
    InsurTechnix believes that it's important to pro-actively defend against ransomware. The costs of e.g. patching OSes, or updating software applications, or blocking RDP ports, etc. are tiny by comparison with direct and indirect costs of attacks. Currently cyber insurance is a game that no-one really wins. That's why we're trying to change the game.
  - PeterisP 6y ago
    Insurance does help the victims - without insurance, the victims are unlikely to see any meaningful compensation from the company who failed in their data safeguarding duty, as the company will simply be bankrupt, the compensations would be far more than they could possibly pay unless they have insurance that will fund the compensation payments.
gonzo41 6y ago
This is not great. Much of the conversation is about insurance to create corporate conditions of good security to avoid the risk. That's a good start. But this isn't like sorting out ID theft or Credit Card fraud. There's no chargebacks for personally damaging information. I'd think 'we' as a IT profession need to start pricing the sort of work we are willing to do. Hey, you want a customer login, $$$, you want to track fine grained information about that person $$$,$$$. You want to create OLAP databases with this data, no thanks I don't want to do the work. One more thing to ponder. It's probably within the reach of the governments of those affected to identify, track and catch the people who did this. So why doesn't the affected company pay 100 million to catch them. And then those that did it go to jail forever. Or have some grizzly fate befall them that follows them around forever. Hacking is white collar crime. When you can effectively price risk in white collar crime you can reduce it. Let's see some hackers do the whole jail term, crying dragged away, everyone thinking there but for the grace of god go I. For certain records, like voting, paper is best.
ChrisMarshallNY 6y ago
This is a classic "Damoclean sword" conundrum. The ability to digitize and aggregate the data, and maybe even subject it to some kinds of AI, might result in massive improvement in therapy. Mental health treatment has come an incredibly long way, just in the last couple of decades. It's even more amazing, when you look at how it went a hundred years ago. Some of the reasons are because of the ability to study treatment methodologies and outcomes. But having the data in a place that can happen, is very, very risky. People with mental health problems tend to be treated as "disposable people" by a lot of folks. I guarantee that the first thing the hackers did, was find a way to "dehumanize" the people in their data. Having the people as "data" went a long way towards that. But people will die as a direct result of this breach. That's not hyperbole. It will happen. Some people will commit suicide, some will avoid treatment, causing all kinds of collateral damage, and some may actually kill other people, because of this. I have a lot of close, personal experience with people suffering from mental health issues, and this is about as bad a nightmare as you can imagine. It will reverberate around the world.
- hutzlibu 6y ago
  "Mental health treatment has come an incredibly long way, just in the last couple of decades." Personally I am not convinced about that. Or do you mean that from an academic perspective? Because in the real world, the therapy method I have mostly seen, was and is keeping people calm with pills.
  - ChrisMarshallNY 6y ago
    Um...I have close, personal, and intimate relationships with many people that suffer from mental illness, and have had this for decades. I do a lot of "extracurricular" work, trying to help folks get back on their feet. So, not academic. Personal. > Because in the real world, the therapy method I have mostly seen, was and is keeping people calm with pills. I consider that offensive. It's a fairly classic "strawman" argument that is used to "dehumanize" people that suffer from mental illness, and also dehumanize people trying to help them. I know many people that would be in very dire straits, if not for medication, therapy, and many years of hard work. I'm pretty upset by this, and by the reactions. I am not a therapist. Just someone with "skin in the game." These aren't "data points." These are people, and chances are good that we all have folks in our orbit that have mental health issues.
tekkk 6y ago
A one hopefully positive thing that comes out of this is the obsolescence of the use of personal information for purchases. I don't know when exactly it was thought that knowing someone's name, address and social security number was enough to make hundreds or thousands worth of credit loans or purchases, but it has to end. Now what you have to do is register at multiple services a block of using your PII for credit loans, company memberships, paper-sent address change etc. It's outrageous how much effort you to have to go through after becoming a victim of a crime, and for at least credit block you have to pay with your own money. Some Finnish MP in Twitter had some good points how to modernize the current system and I dearly wish they would put that on their agenda ASAP. When those 40k names with full addresses, phone numbers, SSNs etc, start getting spread around, it's going to be a hell of a shitshow. Well not that it isn't already. The hacker also accidentally uploaded the whole database for a brief moment, which from my knowledge was downloaded by at least one person, containing most if not all of the mental health records data.
hikerclimb 6y ago
Good.
Dobby2020 6y ago
Let's add "Russian" hackers in the title to make it sound more mainstream XD
- vmception 6y ago
  haha, it still works, the actual hacker gets paid, and the VPN or RPC'd computer in Russia never gets subpoena'd and the real investigation is deflected into thinking about "state sponsored hackers" in Russia, ordered by Putin himself! "17 Intelligence agencies all agree that [the IP address of the computer used by] the hackers were in Russia, how suspicious that you don't!"
- asenk 6y ago
  What's the relevance of your comment to the topic?
1337shadow 6y ago
For what we know and according to RFC 1392, these are crackers, not hackers.
AbenezerMamo 6y ago
Failture on all sides and too costly to ignore.
threatofrain 6y ago
> The information published could not be more sensitive: it included the patient's name, personal identification number, telephone number, email address and residence address, together with the content of the therapy sessions.
bahmboo 6y ago
It would be fun to do some sort of textual style transfer on these docs and flood the zone with hundreds of plausible fakes. Would make hijackers job at least harder.
- CryptoPunk 6y ago
  It would give every victim plausible deniability, as long as at least one of the fakes isn't too embarrassing.
  - rebuilder 6y ago
    I think in reality it would just be mass libel...
linspace 6y ago
Incredibly sad news. And this made me even sadder: "Extortionists demanded around 450,000 euros (in bitcoins) in exchange for not publishing the clinical and mental health data of thousands of people. The criminals started to publish the data of 100 people every day in the encrypted web Tor two days ago." As someone that strongly believes in privacy and freedom I find so depressing that some technologies seem to be exclusively used to commit crimes.
- leppr 6y ago
  Rather: "some technologies seem to exclusively make the news when used to commit crimes." Headlines are not statistics.
  - linspace 6y ago
    You have a point but I don't see other headlines and this considering Hacker News is biased in favor of Tor and Bitcoin
    - leppr 6y ago
      Maybe biased in favour of Tor but Bitcoin definitely not.
gogopuppygogo 6y ago
Mental health issues don't allow for rational thinking. Victims of mental illness may also feel emotional pain in ways that non-sufferers cannot comprehend. I have always had a "tough guy" mentality toward my feelings. I suppress them. I think when others know who I am or how I think it's a weakness in business. Some leaders think its helpful. Either way, I don't feel emotional pain the same way others feel it. How do I know this? I've been around someone close to me who suffers from mental illness for most of my life. This is someone who can feel words in ways that most people feel getting shot. That person has been bed ridden for months because of something that was said to them years ago. They didn't choose to feel that way. They have tried therapy and drugs but to no avail so far. They wish they didn't feel that way but they do. Criticizing this persons work, car, reactions, clothes, etc... will cause a massive disruption in their life. If their information was leaked I can tell you they would seriously contemplate suicide over the public awareness. I hope the people who released this rot in hell for what they did. They took some of the most vulnerable people and quite likely will cause them to snap causing that mental pain to release into others lives. Innocent people will suffer because of this data breach.
- burade 6y ago
  >They didn't choose to feel that way. They weren't born that way either. I guarantee you there has been some massive childhood/adolescence trauma in this person's life. If this person is a woman, then it's veeeery easy to understand why she feels this way.
  - djeiasbsbo 6y ago
    I don't know you but my assumption is that this is but an assumption on your part. Mental illness often results in irrational behaviour, which then often leads to wrong or inaccurate conclusions by the people around a patient, so professional help is very important. That is exactly why this "hijack" is so bad, professional psychotherapists who have studied their field are rare but needed to properly diagnose patients like this. Hackers (and self-proclaimed diagnosers) only make their profession even harder.
say_it_as_it_is 6y ago
There is a code among thieves and this vermin crossed the line. Hopefully, this is one occasion where intelligence and hacker communities can work together to sort out a common enemy.
jimkleiber 6y ago
I've been testing a way to improve emotional health without recording any private information to try to avoid the challenges of hacked/leaked info. I record short audio exercises, where I ask a series of questions with a format like "How do you feel when you think about ___?" and put different scenarios in the blanks, related to a theme. If you listen to the audios, you can answer in your own head, say them outloud (not recorded), or even write them down wherever you want. I'm not sure if any of you would like to try, but I figured people reading this may be interested in super-private ways to try to get better at dealing with emotions. Currently at www.jimkleiber.com/drills edit The main benefit is helping you get better at saying how you feel and imagining how others might be feeling, which can help you release emotions, process them, better understand them, clarify them, and communicate them to yourself and the people around you.
Aeolun 6y ago
Can we just outlaw bitcoin already? It’s really the only way attacks like this are practical.
- leppr 6y ago
  Also outlaw Western Union, gift cards, game items, and all the remaining ways to transfer value internationally. Then, maybe, you could think about going after the actual hackers, exploit sellers, designers and implementers of insecure systems, ... But first ban Bitcoin.
  - Aeolun 6y ago
    Jup. Have you seen any more efficient medium to transfer money internationally? Think of all the difficulties inherent in all the methods you’ve stated above, and compare them to bitcoin (or any cryptocurrency). Of course we can go after thr actual criminals, it would just help if they can be traced.
austincheney 6y ago
I have found it astonishing, from comments in other threads, how many people on HN: * do not believe depression to be an illness * indicate mental health isn’t isn’t real medicine * people shouldn’t consult a medical provider for illnesses of mental health * people should self medicate
- _def 6y ago
  That is a sad state but does not really surprise me. The social stigma is still very big and visible in most areas of society. Avoidance, ignorance and fear play a big role too, I guess. There needs to be more education regarding the topic.
- newcomputer 6y ago
  "There are bad guys in other threads, but I will not link or provide any evidence at all to support this" You should reply to those people directly, instead of polluting irrelevant threads with your boogeyman complaints.
- cutemonster 6y ago
  > from comments in other threads, Is that in this topic about the leak, or generally at hn? I'd suspect society in general is even less understanding about mental health problems
  - austincheney 6y ago
    Generally at HN. Occasionally people will ask for advice about depression or anxiety. If you suggest seeing a doctor you are greeted with an emotional event.
CryptoPunk 6y ago
It should be illegal to pay these ransoms. It only encourages more data raids. When it does happen, the victims should be compensated for the losses they suffer, but they should also be told that, in the end, it's just data, and how they react to other people becoming privy to it is something they can exert control over. They need to be told that they can choose to be resilient, and that this is a survivable event.
- cutemonster 6y ago
  This is harmful advice > need to be told that they can choose to be resilient And a poor understanding of humans and mental illness
  - CryptoPunk 6y ago
    It seems like encouraging people to identify with their trauma is what's harmful: https://www.psychologicalscience.org/news/releases/trigger-warnings-fail-to-help.html https://www.psychologicalscience.org/news/releases/trigger-w... Identifying positive traits in people diagnosed with mental illness - and resiliency would be one of them - seems to have a positive impact: https://www.tandfonline.com/doi/full/10.1080/17522439.2014.925485 https://www.tandfonline.com/doi/full/10.1080/17522439.2014.9... Corroborating this is the fact that exposure therapy, which implicitly assumes that the patient does have resiliency, has been found to be an effective treatment for a number of psychological disorders: https://www.apa.org/ptsd-guideline/patients-and-families/exposure-therapy#:~:text=The%20exposure%20to%20the%20feared,Panic%20Disorder https://www.apa.org/ptsd-guideline/patients-and-families/exp...
    - cutemonster 6y ago
      Interesting links, thanks. I like the "encourage resiliency"mindset. You seem to have in mind people who experienced something traumatic in the past, and/or are fearful of sth. I wonder if things like bipolar or borderline or OCD or depression or schizophrenia didn't occur to you? Then there's not always any past trauma to be resilient against? > should also be told that, in the end, it's just data, and how they react to other people becoming privy to it is something they can exert control over This data can in some cases get them fired from a job, or bullied, and more, I think it's not true that it's just data -- it's more like a threat.
cromulent 6y ago
The hackers are also contacting the patients directly. A friend of ours was a Vastaamo customer a couple of years ago and received their extortion email yesterday. The amount demanded initially surprised me as being quite affordable, but I guess that's how extortion / blackmail works - there's never just one payment. It was different to the amount specified in the article.
- nikanj 6y ago
  NB: Everyone in the leak got that email, and all of those emails have the same bitcoin wallet. [To be exact, emails went out in batches and each batch has a shared wallet]. We've been trying to spread the good word and make people understand the hackers can't know who paid, because they didn't generate a wallet for every single user. If they can't know who paid, how would they be able to delete your data. But many people will probably end up paying, because 200 euros seems like a low price to keep your dignity and privacy.
  - rebuilder 6y ago
    Do you have a source for the Bitcoin addresses being reused? I ask because YLE is running an article claiming each address is unique, meaning the extortionist could identify who has paid. If that is not the case, I'd like to notify YLE about it as it's a pretty important point.
    - nikanj 6y ago
      Source: Me. We compared messages with five people who got the blackmail message, and four of them had the same wallet. Sorry, I don't have a news page to link.
- rebuilder 6y ago
  someone is contacting the patients. The archive of patient data, a 10 GB file apparently, is said to have been available on TOR for a while. (I have not verified this, I'm relying on Finnish media here.) Whoever is mailing patients with demands, may or may not be the original extortionist. Either way, it does not seem like anyone can keep the data from being disseminated now, so paying ransoms is pointless.
TheButlerian 6y ago
We should be moving away from computers, especially in places where this won't come with high cost.
wiz21c 6y ago
I wonder if the company name was chosen on purpose :-)
Lio 6y ago
It would be interesting to know if companies like Facebook and Google view leaked information like this as “fair game” and in the public domain. Would they add it to their graphs if their missions are to know everything about everyone? For example, the existence of shadow profiles shows that Facebook don’t care whether they have your consent or not. In the UK Google have made strenuous efforts to get hold of NHS medical data, sometimes with dubious consent[1]. If you specifically asked you might be able to get them to remove about you but I doubt you’d get them to remove what they’d learned from their models. 1. https://www.newscientist.com/article/2217939-google-is-taking-over-deepminds-nhs-contracts-should-we-be-worried/ https://www.newscientist.com/article/2217939-google-is-takin...
jjones2 6y ago
It is extremely unfortunate, but every time sensitive data like this is collected and stored it is abused in many different ways. You would have to be crazy (no pun intended) to use these services after all this.
ElijahLynn 6y ago
I wonder if the hacker themselves was a patient in the database. Do they have a grudge? Obviously they have mental health issues themselves and likely have been to a therapist themselves already. Maybe that is where they got the idea?

417 points by aaron695 6y ago

Also reported they are targeting the individuals - "A blackhat hacker has stolen therapy notes and personal identification of supposefly 40 000 people in #finland, tried to blackmail the target organisation @vastaamo and now targets durectly the individuals. Possible the most outrageous blackmailing ever in the country, (1/2)" "and even wider. Finnish police @PoliisiTiedote tells crime reporting system is down, presumably because of the large number of victims reporting their case. (2/2)" https://twitter.com/ropsue/status/1320086169489637378 https://twitter.com/ropsue/status/1320086169489637378

SebaSeba 6y ago

Some current background info: The breach and the extortion emails are at the moment on the front page of all major Finnish news publications. The Finnish government main ministers are discussing on how to handle the potential crisis, since there are possibly 40 000 patients' records leaked and some of the victims are already in a very vulnerable state and might be feeling even more desperate if their traumas will be publicly shared online. It is also known that there are minors among the victims. https://yle.fi/uutiset/osasto/news/psychotherapy_centre_reveals_two_separate_data_breaches_of_sensitive_patient_information/11612453 https://yle.fi/uutiset/osasto/news/psychotherapy_centre_reve...

raverbashing 6y ago

If companies are happy to pay ransoms they can't complain about being extorted for higher fees What is needed is actual investigation and prosecution of cases.

Nextgrid 6y ago
What is needed is also liability for those responsible for managing that data, and maybe an argument that certain data shouldn’t be created to begin with? Content of therapy sessions should maybe not have been kept in a digital format to begin with.
MeinBlutIstBlau 6y ago
Hello, but why are backups not a thing? It's like the majority of these companies don't even bother with them.
- raverbashing 6y ago
  Backups would mean nothing in this case
- nogabebop23 6y ago
  this doesn't appear to be a ransomware attack, just plain old blackmail. Insecure backups would actually make it worse...

ollifi 6y ago

Tool to check if your information has been leaked (based on e-mail) https://www.tietovuodot.fi/ https://www.tietovuodot.fi/

ThrAwayOb 6y ago
Who runs this page and why can (or can't) be trusted ?
- ollifi 6y ago
  It’s supposedly run by private individual identified in the page. It is possible that it is harvesting e-mail addresses, but does not require other info.

hpaavola 6y ago

The person who claimed to be the "hacker" commented on Finnish 4chan-like board (kuvalauta) that the credentials to access the servers were root:root. AFAIK there's no evidence for or against the claim, but if true, I see two quilty parties here.

michaericalribo 6y ago
This is a false equivalence, and victim blaming. Using root:root credentials is sloppy and poor dev practices, but that is minuscule compared with extortion and inflicting widespread stress on a vulnerable population. There’s a reason we have laws against both negligent manslaughter and first degree murder, and there’s also a reason why the penalties for the latter are much more severe than for the former.
- fastball 6y ago
  Nobody said that they were equivalent, just that there are multiple guilty parties. Not guilty of the same thing, but guilty nonetheless. It's not victim blaming because the victims are the patients. The people who were in charge of securing the records and left the creds as root:root are not victims.
  - TeaDrunk 6y ago
    IMO we are using the language of someone who we know to act maliciously on a massive scale (tens of thousands of people, including minors)as if their words can mean anything without corroboration. Frankly I wouldn't believe a rapist saying "but look at what they were wearing" or a serial killer for saying "but they went home alone". Similarly, I don't hold any credence to a black hat saying "but look at how insecure they were".
    - deleted 6y ago
      [deleted]
    - fastball 6y ago
      Again, nobody is blaming the victims. People hired to secure records that then do an exceedingly poor job are not the victims in this situation. Victims == patients. In your analogies of rape/murder, the (almost) equivalent would be if there was a doorman at an apartment building who was supposed to verify the identity of everyone entering the building, but failed to do so, letting the unauthorized perpetrator into the building and thus allowing the victim to be raped/murdered. It was literally his job to prevent such a situation, and he failed. You maintain that he has no responsibility in this matter?

deleted 6y ago

[deleted]

callias 6y ago

I wonder what countries, if any, give the patient the right to have obviously non-critical information deleted from his health records. In Norway, at least, if you talk to a shrink, there's no easy way to have the record of that conversation deleted; you have only to sit and wait for something like this to happen.

mlang23 6y ago

Clearly this information should never have been allowed to be stored digitally. Those to blame are those which neglected to put the necessary precautions in place. Where I come from, if you forget to lock your car, police can collect the key and fine you for your ignorance. Same should apply when health data gets lost. The patients have virtually no control over what happens with their data after someone entered it into a system. So all the mishap which happen need to be blamed on those which run these systems. Not doing so is a pretty blatant attempt of ignoring responsibilities.

Const-me 6y ago
> Where I come from, if you forget to lock your car, police can collect the key and fine you for your ignorance. Where I live, people sometimes intentionally leave keys in their unlocked cars, for convenience of people who sharing a parking space.
- C19is20 6y ago
  My car was open and had keys in...it got stolen and found 20km away. No damage. Several other cars in the street had broken windows and signs of attempted hot-wiring. Cost to me - time. Cost to everyone else... they're all still pretty livid. Even more so that my car was about 15th in a line of 20. If it had have been first - different outcome. YMMV.
  - nogabebop23 6y ago
    not sure I would leave the keys in my unlocked car, but when I lived in a city with a lot more petty crime many people left their doors unlocked and some spare change in the cup holder. Everyday it was gone but no other damage vs. smashed windows for no gain. It pissed me off but others saw it as equivalent to pay for parking
  - mlang23 6y ago
    You were lucky. Dont you think your analysis is a bit egocentrical though? What if there was a major accident during that 20km drive? What if someone was killed with your unlocked car? Is the damage to your property still your only concern?

imposter 6y ago

>The information published could not be more sensitive: it included the patient's name, personal identification number, telephone number, email address and residence address, together with the content of the therapy sessions. That's just pure evil.

nabla9 6y ago
It's incredibly cruel. Blackmailers are now sending emails to people in the database directly. People already bad shape are put into huge stress. There can be suicides. According discussion in Finnish reddit /r/suomi, in the released data batch was therapy discussion involving person who struggled with pedophilic impulses. That's a life ruined.
- tartoran 6y ago
  That is clearly a cruel thing to do to a person who has those impulses but never acted on them and seeking therapy to get rid of them. This will erode trust in therapists and make people think twice about seeking professional help.
  - gonzo41 6y ago
    If that person doesn't kill themselves they very well may, untreated hurt children. It's staggering how massive this is.

INGELRII 6y ago

This issue can be solved with mandatory insurance and compensation structure. For this sensitive private health information compensation should be at least 5 figures per person, no excuses. A data breach involving 10,000 people could cost 100s of millions. Companies would have to take mandatory insurance against massive data leaks. In order to keep insurance fees reasonable, they would have to implement good security. Insurance companies would do audits because they don't want to lose money. They would promote secure data vaults, require hardware authentication devices from their customers in exchange of insuring them. Car manufacturers must be prepared to do massive recalls in case there is a fault in the car. Automotive recall insurance is a big business. Same thing. Regulatory structures protecting consumers.

OpticalWindows 6y ago
I think we need to make it at minimum 6 figures per person for adequate protection. Once information is out there is no taking it back. Banks, jobs will use all information against you. Electronic survalence is just another form of "Public HR" sure someone could intentionally post shit online to fuck with these systems but the creators have no remorse for such "people" as they are "degenrate" to try to destroy such "high minded" systems.
- seibelj 6y ago
  It should be 7 figures. How can we put a price on knowing how often you go to the doctor?
  - baobabKoodaa 6y ago
    Sure, and while we're at it, why don't we make it a gazillion euros. After all, you can't put a price on privacy.
    - contravariant 6y ago
      Actually it should be free, after all you can't put a price on privacy.

chaps 6y ago

Heh, years ago I wanted to see if some mental health info of mine was accessible over the internet of a major university. Nothing fancy, just did a port scan of their IP range. I found that they had dozens of their psychology department's printers accessible over the internet. So, I contacted their office, telling them that PII was likely accessible through these printers (through exploits), and asked that they look into why so many internal machines were accessible over the internet, and to at least remove the printers from the internet. They responded by telling me that there were no internet-accesible printers and that their scans would have detected something like that.. and then asked that I send them any PII. I didn't, but... it truly felt like they were trying to set me up for throwing the blame my way. It's really bad out there.

unstatusthequo 6y ago
I would have printed the message using their printers. Maybe that would have been more effective?
- siberianbear 6y ago
  I think the grandparent comment made the right call. It could have worked out well. Or perhaps the university would have taken disciplinary action against him for "hacking" the university computer system. No good deed goes without punishment.
- lucb1e 6y ago
  More effective, perhaps, but it's also dancing on the edge of the law. In the Netherlands the public prosecutor doesn't pursue cases of ethical hacking (afaik the other party can still file a civil case if there are damages though, and I would assume reputational damage counts), but they totally made a case against a person that claimed to be white hat but offered to fix the problem for around 20'000 euros. Specifically: > De man nam contact op met de praktijk en meldde dat een kwetsbaarheid toegang bood tot de persoonlijke gegevens van artsen, waaronder e-mailadressen, gebruikersnamen, wachtwoorden en bankrekeningnummers. Vervolgens stuurde hij een offerte met het aanbod om voor 16.500 tot 23.000 euro de kwetsbaarheid te verhelpen. In die offerte stond volgens het OM een 'dreigende mededeling': "Er zal waarschijnlijk een boete betaald moeten worden wanneer dit openbaar is en er zal een flinke reputatieschade plaatsvinden." Het OM schrijft dat de politie na onderzoek constateerde dat op de laptop van de man de gevoelige persoonsgegevens stonden en dat zijn ip-adres te relateren was aan de inbraak. From https://tweakers.net/nieuws/167792/om-eist-twee-maanden-cel-voor-vinden-lek-en-aanbod-dat-voor-geld-te-dichten.html https://tweakers.net/nieuws/167792/om-eist-twee-maanden-cel-... Summary translation: he found an issue in a doctor's office, told them "you'll probably get fined if this becomes public and there will be large reputational damage" and sent an offer for 16.5-23k euros for a fix. The public prosecutor saw the message as threatening (blackmail) and therefore decided this wasn't simply a white hat reporting an issue and offering legitimate services. Upon investigating, sensitive personal data was found on his laptop. So is hacking into their printers to send a message proportional to the issue? I would say yes, but one might also argue this goes beyond what is strictly necessary to prove the issue. (Another guideline is that downloading your own PII to confirm an issue is fine, and that it can also be fine if you accidentally find PII but don't request more than that first record, but nothing beyond that.) You might argue that they didn't listen, but I don't know if that's an argument a judge finds compelling. Different countries can have different systems, not sure how white hat hacking is treated in Iran, the USA, Brazil, or other countries that seem to enjoy putting a lot of citizens behind bars.

danieka 6y ago

IANAL but of you are impacted by this you should seriously consider filing a civil suit against the data controller. The most interesting article of the GDPR for you will be article 82 which entitles you to compensation if you have been materially or immaterially harmed. If your personal information has been leaked this would a clear case of immaterial damage. It has probably caused you anguish and is a violation of your right to privacy. In this case you will have a huge advantage since there is a police investigation which no doubt will provide you with plenty of evidence to use in your civil suit. Once you have proven that your data has been leaked the defendant/data controller has the burden of proof to show that they are in no way responsible for the damage caused to you. As I said, IANAL, but I was personally involved in a similar case in Sweden which did go to trial (and then settled). Hopefully there will be a class action against the data controller. EDIT: Once again IANAL, but if you have questions reach out to me on mail@danielk.se and hopefully I can give you pointers for your research.

pavlov 6y ago
The upside is probably very limited. A private psychotherapy provider in Finland doesn’t have millions in their bank account. They’re effectively bankrupted by this news already, as business grinds to a halt. By the time a class action suit awards something to the victims, the company will be long gone.
- fogihujy 6y ago
  The GDPR fines alone might end up bankrupting them (and rightfully so IMO). The only upside, if any, is that this might serve as a warning to anyone claiming that one doesn't have anything to worry bout if one doesn't have anything to hide.
- anttisalmela 6y ago
  Class action is very limited in Finland - the law that allows this is quite recent, there has been no class action suits yet at all and I'm not sure if it would be even applicable here.
  - 6y ago

DoofusOfDeath 6y ago

Does anyone know if state intelligence agencies have the capability of hunting down this kind of hacker? I would think that their need to receive ransom money would limit their ability to hide completely.

beagle3 6y ago
Likely yes, but at a cost they wouldn’t want to pay, because it will “burn” their ability to do this in cases they likely deem more important, such as those where lives and state security are directly threatened. In the US, the NSA likely has enough data to solve 85% of all unsolved crime, and to prove innocence of 95% wrongly accused; but doing so would limit their future abolity to do so (and the ability to do their actual job) so they won’t.
- hh3k0 6y ago
  And 42.7% of all statistics are made up on the spot.
  - beagle3 6y ago
    True, I should have added "(statistics that seem right to me that I pulled out of thin air)". That said, Snowden disclosures and others indicate that if there's an email, voice call, location information or any other digital piece of information, it is accessible to the NSA, not warrants required.

notRobot 6y ago

There's a well known phenomenon where if the infosec division of a company is working well, it's not obvious at all to management, because no leaks are taking place. So their budget gets cut. And then the data leaks/breaches happen. Once a leak happens, the infosec division gets free reign for a few years. Until a new manager goes all "you guys don't even do anything!", and the cycle repeats.

beagle3 6y ago
Also known as “the bathrooms here are always so clean here, we can fire the janitors!” line of reasoning.

brightball 6y ago

Stuff like this was my biggest concern with the mandates for digital transformation in medical record keeping. The security of a locked file cabinet cannot be understated.

Hamuko 6y ago
>The security of a locked file cabinet cannot be understated. It doesn't take much to defeat a file cabinet lock.
- blackbrokkoli 6y ago
  It does however is quite hard to do it in hundreds of locations, possible undetected, over prolonged time periods without being personally there. "I can always go and stab someone" is not an argument pro autonomous killing drones either.
- Laakeri 6y ago
  Defeating file cabinet locks in this scale would

Indy9000 6y ago

There's no good reason to have personally identifiable information stored in the system. They could easily issue each patient an alphanumeric ID which is not tied to personal information yet uniquely distinguishable.. This is a system design failure to begin with. Design sensitive systems with only minimum required information. The alternative is to have a massive framework to make sure PII hadn't leaked. And then a legal and financial frameworks on top of that.. after all if a leak happens it can't be undone. Damage to the people will be long standing and cascading. Best is to have a system that have no or minimum PII.

chrisseaton 6y ago
> There's no good reason to have personally identifiable information stored in the system. They’re medical records. Seems inherently likely to be PII?
- Indy9000 6y ago
  Medical records can be stored without personally identifiable information (PII). And they should be. That's what I'm proposing.
  - Hamuko 6y ago
    How do you link a person's medical history to a person without personally identifiable information?
    - Indy9000 6y ago
      Medical history has to be only meaningful between doctor and patient. Doctor can keep records under a unique ID which patient is given at the start of sessions and the patient presents it at each session to validate the relationship. In the event of a breach, even when all data is exposed, without tracking the unique ID back to a person (which would be difficult or impossible) the harm is little.. (Imagine reading a story of a person but you don't know who that person is..) You might say that there would be other person names and places in mentioned in the records and from that network and timeline you may be able to deduce the identity.. but these PII can in turn be depersonalised. And also this is not scalable for widespread damage. It just need a bit of thinking when designing a system. Frankly any org that ask for PII and doesn't have a well thought out way to store them should be heavily penalised. That's what the law should do standardised methods of storing sensitive data.

mtm7 6y ago

This has to be a nightmare for the patients. According to the article, some are already struggling with depression and anxiety. > The information published could not be more sensitive: it included the patient's name, personal identification number, telephone number, email address and residence address, together with the content of the therapy sessions.

JohnCClarke 6y ago

Co-founder of InsurTechnix here. Our tech helps cyber insurers provide pro-active risk mitigation inside of just financial risk transfer. My Mom suffered her whole life from manic depression and schizophrenia so I can imagine what the victims of these attacks are going through. The reason we like cyber insurance as a channel for cyber security is that the insurers have "skin in the game" in because they pay out for incidents.

robocat 6y ago
Who do the insurers pay out? If a company indemnifies themselves through insurance, they have increased their moral hazard (ignoring balanced decreases in other areas). Insurance doesn’t help the victims.
- JohnCClarke 6y ago
  InsurTechnix believes that it's important to pro-actively defend against ransomware. The costs of e.g. patching OSes, or updating software applications, or blocking RDP ports, etc. are tiny by comparison with direct and indirect costs of attacks. Currently cyber insurance is a game that no-one really wins. That's why we're trying to change the game.
- PeterisP 6y ago
  Insurance does help the victims - without insurance, the victims are unlikely to see any meaningful compensation from the company who failed in their data safeguarding duty, as the company will simply be bankrupt, the compensations would be far more than they could possibly pay unless they have insurance that will fund the compensation payments.

gonzo41 6y ago

This is not great. Much of the conversation is about insurance to create corporate conditions of good security to avoid the risk. That's a good start. But this isn't like sorting out ID theft or Credit Card fraud. There's no chargebacks for personally damaging information. I'd think 'we' as a IT profession need to start pricing the sort of work we are willing to do. Hey, you want a customer login, $$$, you want to track fine grained information about that person $$$,$$$. You want to create OLAP databases with this data, no thanks I don't want to do the work. One more thing to ponder. It's probably within the reach of the governments of those affected to identify, track and catch the people who did this. So why doesn't the affected company pay 100 million to catch them. And then those that did it go to jail forever. Or have some grizzly fate befall them that follows them around forever. Hacking is white collar crime. When you can effectively price risk in white collar crime you can reduce it. Let's see some hackers do the whole jail term, crying dragged away, everyone thinking there but for the grace of god go I. For certain records, like voting, paper is best.

ChrisMarshallNY 6y ago

This is a classic "Damoclean sword" conundrum. The ability to digitize and aggregate the data, and maybe even subject it to some kinds of AI, might result in massive improvement in therapy. Mental health treatment has come an incredibly long way, just in the last couple of decades. It's even more amazing, when you look at how it went a hundred years ago. Some of the reasons are because of the ability to study treatment methodologies and outcomes. But having the data in a place that can happen, is very, very risky. People with mental health problems tend to be treated as "disposable people" by a lot of folks. I guarantee that the first thing the hackers did, was find a way to "dehumanize" the people in their data. Having the people as "data" went a long way towards that. But people will die as a direct result of this breach. That's not hyperbole. It will happen. Some people will commit suicide, some will avoid treatment, causing all kinds of collateral damage, and some may actually kill other people, because of this. I have a lot of close, personal experience with people suffering from mental health issues, and this is about as bad a nightmare as you can imagine. It will reverberate around the world.

hutzlibu 6y ago
"Mental health treatment has come an incredibly long way, just in the last couple of decades." Personally I am not convinced about that. Or do you mean that from an academic perspective? Because in the real world, the therapy method I have mostly seen, was and is keeping people calm with pills.
- ChrisMarshallNY 6y ago
  Um...I have close, personal, and intimate relationships with many people that suffer from mental illness, and have had this for decades. I do a lot of "extracurricular" work, trying to help folks get back on their feet. So, not academic. Personal. > Because in the real world, the therapy method I have mostly seen, was and is keeping people calm with pills. I consider that offensive. It's a fairly classic "strawman" argument that is used to "dehumanize" people that suffer from mental illness, and also dehumanize people trying to help them. I know many people that would be in very dire straits, if not for medication, therapy, and many years of hard work. I'm pretty upset by this, and by the reactions. I am not a therapist. Just someone with "skin in the game." These aren't "data points." These are people, and chances are good that we all have folks in our orbit that have mental health issues.

tekkk 6y ago

A one hopefully positive thing that comes out of this is the obsolescence of the use of personal information for purchases. I don't know when exactly it was thought that knowing someone's name, address and social security number was enough to make hundreds or thousands worth of credit loans or purchases, but it has to end. Now what you have to do is register at multiple services a block of using your PII for credit loans, company memberships, paper-sent address change etc. It's outrageous how much effort you to have to go through after becoming a victim of a crime, and for at least credit block you have to pay with your own money. Some Finnish MP in Twitter had some good points how to modernize the current system and I dearly wish they would put that on their agenda ASAP. When those 40k names with full addresses, phone numbers, SSNs etc, start getting spread around, it's going to be a hell of a shitshow. Well not that it isn't already. The hacker also accidentally uploaded the whole database for a brief moment, which from my knowledge was downloaded by at least one person, containing most if not all of the mental health records data.

hikerclimb 6y ago

Good.

Dobby2020 6y ago

Let's add "Russian" hackers in the title to make it sound more mainstream XD

vmception 6y ago
haha, it still works, the actual hacker gets paid, and the VPN or RPC'd computer in Russia never gets subpoena'd and the real investigation is deflected into thinking about "state sponsored hackers" in Russia, ordered by Putin himself! "17 Intelligence agencies all agree that [the IP address of the computer used by] the hackers were in Russia, how suspicious that you don't!"
asenk 6y ago
What's the relevance of your comment to the topic?

1337shadow 6y ago

For what we know and according to RFC 1392, these are crackers, not hackers.

AbenezerMamo 6y ago

Failture on all sides and too costly to ignore.

threatofrain 6y ago

> The information published could not be more sensitive: it included the patient's name, personal identification number, telephone number, email address and residence address, together with the content of the therapy sessions.

bahmboo 6y ago

It would be fun to do some sort of textual style transfer on these docs and flood the zone with hundreds of plausible fakes. Would make hijackers job at least harder.

CryptoPunk 6y ago
It would give every victim plausible deniability, as long as at least one of the fakes isn't too embarrassing.
- rebuilder 6y ago
  I think in reality it would just be mass libel...

linspace 6y ago

Incredibly sad news. And this made me even sadder: "Extortionists demanded around 450,000 euros (in bitcoins) in exchange for not publishing the clinical and mental health data of thousands of people. The criminals started to publish the data of 100 people every day in the encrypted web Tor two days ago." As someone that strongly believes in privacy and freedom I find so depressing that some technologies seem to be exclusively used to commit crimes.

leppr 6y ago
Rather: "some technologies seem to exclusively make the news when used to commit crimes." Headlines are not statistics.
- linspace 6y ago
  You have a point but I don't see other headlines and this considering Hacker News is biased in favor of Tor and Bitcoin
  - leppr 6y ago
    Maybe biased in favour of Tor but Bitcoin definitely not.

gogopuppygogo 6y ago

Mental health issues don't allow for rational thinking. Victims of mental illness may also feel emotional pain in ways that non-sufferers cannot comprehend. I have always had a "tough guy" mentality toward my feelings. I suppress them. I think when others know who I am or how I think it's a weakness in business. Some leaders think its helpful. Either way, I don't feel emotional pain the same way others feel it. How do I know this? I've been around someone close to me who suffers from mental illness for most of my life. This is someone who can feel words in ways that most people feel getting shot. That person has been bed ridden for months because of something that was said to them years ago. They didn't choose to feel that way. They have tried therapy and drugs but to no avail so far. They wish they didn't feel that way but they do. Criticizing this persons work, car, reactions, clothes, etc... will cause a massive disruption in their life. If their information was leaked I can tell you they would seriously contemplate suicide over the public awareness. I hope the people who released this rot in hell for what they did. They took some of the most vulnerable people and quite likely will cause them to snap causing that mental pain to release into others lives. Innocent people will suffer because of this data breach.

burade 6y ago
>They didn't choose to feel that way. They weren't born that way either. I guarantee you there has been some massive childhood/adolescence trauma in this person's life. If this person is a woman, then it's veeeery easy to understand why she feels this way.
- djeiasbsbo 6y ago
  I don't know you but my assumption is that this is but an assumption on your part. Mental illness often results in irrational behaviour, which then often leads to wrong or inaccurate conclusions by the people around a patient, so professional help is very important. That is exactly why this "hijack" is so bad, professional psychotherapists who have studied their field are rare but needed to properly diagnose patients like this. Hackers (and self-proclaimed diagnosers) only make their profession even harder.

say_it_as_it_is 6y ago

There is a code among thieves and this vermin crossed the line. Hopefully, this is one occasion where intelligence and hacker communities can work together to sort out a common enemy.

jimkleiber 6y ago

I've been testing a way to improve emotional health without recording any private information to try to avoid the challenges of hacked/leaked info. I record short audio exercises, where I ask a series of questions with a format like "How do you feel when you think about ___?" and put different scenarios in the blanks, related to a theme. If you listen to the audios, you can answer in your own head, say them outloud (not recorded), or even write them down wherever you want. I'm not sure if any of you would like to try, but I figured people reading this may be interested in super-private ways to try to get better at dealing with emotions. Currently at www.jimkleiber.com/drills edit The main benefit is helping you get better at saying how you feel and imagining how others might be feeling, which can help you release emotions, process them, better understand them, clarify them, and communicate them to yourself and the people around you.

Aeolun 6y ago

Can we just outlaw bitcoin already? It’s really the only way attacks like this are practical.

leppr 6y ago
Also outlaw Western Union, gift cards, game items, and all the remaining ways to transfer value internationally. Then, maybe, you could think about going after the actual hackers, exploit sellers, designers and implementers of insecure systems, ... But first ban Bitcoin.
- Aeolun 6y ago
  Jup. Have you seen any more efficient medium to transfer money internationally? Think of all the difficulties inherent in all the methods you’ve stated above, and compare them to bitcoin (or any cryptocurrency). Of course we can go after thr actual criminals, it would just help if they can be traced.

austincheney 6y ago

I have found it astonishing, from comments in other threads, how many people on HN: * do not believe depression to be an illness * indicate mental health isn’t isn’t real medicine * people shouldn’t consult a medical provider for illnesses of mental health * people should self medicate

_def 6y ago
That is a sad state but does not really surprise me. The social stigma is still very big and visible in most areas of society. Avoidance, ignorance and fear play a big role too, I guess. There needs to be more education regarding the topic.
newcomputer 6y ago
"There are bad guys in other threads, but I will not link or provide any evidence at all to support this" You should reply to those people directly, instead of polluting irrelevant threads with your boogeyman complaints.
cutemonster 6y ago
> from comments in other threads, Is that in this topic about the leak, or generally at hn? I'd suspect society in general is even less understanding about mental health problems
- austincheney 6y ago
  Generally at HN. Occasionally people will ask for advice about depression or anxiety. If you suggest seeing a doctor you are greeted with an emotional event.

CryptoPunk 6y ago

It should be illegal to pay these ransoms. It only encourages more data raids. When it does happen, the victims should be compensated for the losses they suffer, but they should also be told that, in the end, it's just data, and how they react to other people becoming privy to it is something they can exert control over. They need to be told that they can choose to be resilient, and that this is a survivable event.

cutemonster 6y ago
This is harmful advice > need to be told that they can choose to be resilient And a poor understanding of humans and mental illness
- CryptoPunk 6y ago
  It seems like encouraging people to identify with their trauma is what's harmful: https://www.psychologicalscience.org/news/releases/trigger-warnings-fail-to-help.html https://www.psychologicalscience.org/news/releases/trigger-w... Identifying positive traits in people diagnosed with mental illness - and resiliency would be one of them - seems to have a positive impact: https://www.tandfonline.com/doi/full/10.1080/17522439.2014.925485 https://www.tandfonline.com/doi/full/10.1080/17522439.2014.9... Corroborating this is the fact that exposure therapy, which implicitly assumes that the patient does have resiliency, has been found to be an effective treatment for a number of psychological disorders: https://www.apa.org/ptsd-guideline/patients-and-families/exposure-therapy#:~:text=The%20exposure%20to%20the%20feared,Panic%20Disorder https://www.apa.org/ptsd-guideline/patients-and-families/exp...
  - cutemonster 6y ago
    Interesting links, thanks. I like the "encourage resiliency"mindset. You seem to have in mind people who experienced something traumatic in the past, and/or are fearful of sth. I wonder if things like bipolar or borderline or OCD or depression or schizophrenia didn't occur to you? Then there's not always any past trauma to be resilient against? > should also be told that, in the end, it's just data, and how they react to other people becoming privy to it is something they can exert control over This data can in some cases get them fired from a job, or bullied, and more, I think it's not true that it's just data -- it's more like a threat.

cromulent 6y ago

The hackers are also contacting the patients directly. A friend of ours was a Vastaamo customer a couple of years ago and received their extortion email yesterday. The amount demanded initially surprised me as being quite affordable, but I guess that's how extortion / blackmail works - there's never just one payment. It was different to the amount specified in the article.

nikanj 6y ago
NB: Everyone in the leak got that email, and all of those emails have the same bitcoin wallet. [To be exact, emails went out in batches and each batch has a shared wallet]. We've been trying to spread the good word and make people understand the hackers can't know who paid, because they didn't generate a wallet for every single user. If they can't know who paid, how would they be able to delete your data. But many people will probably end up paying, because 200 euros seems like a low price to keep your dignity and privacy.
- rebuilder 6y ago
  Do you have a source for the Bitcoin addresses being reused? I ask because YLE is running an article claiming each address is unique, meaning the extortionist could identify who has paid. If that is not the case, I'd like to notify YLE about it as it's a pretty important point.
  - nikanj 6y ago
    Source: Me. We compared messages with five people who got the blackmail message, and four of them had the same wallet. Sorry, I don't have a news page to link.
rebuilder 6y ago
someone is contacting the patients. The archive of patient data, a 10 GB file apparently, is said to have been available on TOR for a while. (I have not verified this, I'm relying on Finnish media here.) Whoever is mailing patients with demands, may or may not be the original extortionist. Either way, it does not seem like anyone can keep the data from being disseminated now, so paying ransoms is pointless.

TheButlerian 6y ago

We should be moving away from computers, especially in places where this won't come with high cost.

wiz21c 6y ago

I wonder if the company name was chosen on purpose :-)

Lio 6y ago

It would be interesting to know if companies like Facebook and Google view leaked information like this as “fair game” and in the public domain. Would they add it to their graphs if their missions are to know everything about everyone? For example, the existence of shadow profiles shows that Facebook don’t care whether they have your consent or not. In the UK Google have made strenuous efforts to get hold of NHS medical data, sometimes with dubious consent[1]. If you specifically asked you might be able to get them to remove about you but I doubt you’d get them to remove what they’d learned from their models. 1. https://www.newscientist.com/article/2217939-google-is-taking-over-deepminds-nhs-contracts-should-we-be-worried/ https://www.newscientist.com/article/2217939-google-is-takin...

jjones2 6y ago

It is extremely unfortunate, but every time sensitive data like this is collected and stored it is abused in many different ways. You would have to be crazy (no pun intended) to use these services after all this.

ElijahLynn 6y ago

I wonder if the hacker themselves was a patient in the database. Do they have a grudge? Obviously they have mental health issues themselves and likely have been to a therapist themselves already. Maybe that is where they got the idea?