15 ms·

Therapy patients blackmailed for cash after clinic data breach

246 points by velmu 6y ago

reagent_finder 6y ago
Apparent timeline: 2018 Nov: Company breached, seems most likely database of 40,000 mental health records including PII (duh), contact information and treatment history and notes was stolen at this time. 2019 Mar: Another breach. This causes Vastaamo to increase security and close the holes the hackers used. 2019 Apr/May: Independent security company (not named) performs audit since the company was to be sold. Some improvements were suggested, no major security flaws were found. 2020 Aug/Sep: Vastaamo receives threat from hacker if they will not pay 40BTC the hacker will release the database. Until they do the hacker will release 100 records per day. 2020 Sep/Oct: Infosec company Nixu researches Vastaamo systems, reporting that the breach that stole the database was probably made in November 2018, possibly single records in subsequent breaches. 2020 Oct: Individuals whose information was not in the already-leaked records have been contacted and extorted individually. After that, in no particular order: * 300 records have been leaked. The hacker seems to have stopped, though. * Single records not included in the 400 have surfaced on TOR web * A site on TOR was up for a while with several similarly-named files, one a 10GB tar that is rumored to be database. Partial downloads have been reported. Edit: Also program snippets etc included, with possible 'digital fingerprint' according to Mikko Hyppönen, a well-known Finnish security expert. * An IP address related to the hack has been traced to Inkoo, Finland. CEO claims the 2020 Nixu report was the first time he heard of the breaches and that's why the new CEO or board were not informed -- which seems awfully sus, considering several breaches were made and a reactionary battering down the hatches as well as an external audit were made. Further, people who work or used to work at Vastaamo have come out claiming toxic work environment, threats of lawsuits if they speak out against the company, bad working conditions and a large number of ethical violations (like using as advertisement names and reputation of people who don't work for them). It also appears they've been sending social security numbers in plaintext over email. Claims have also been made that the database and system were outdated and only had default passwords and no real attempt at securing the data or even servers have been made, but of course nothing is public yet. Possibly never will be. All in all, looks like the previous owner is a bona fide scumbag with all the bells and whistles that entail. And, of course as is fashionable, when asked about these things his responses have been "I have no knowledge of that" and "I do not recall." And, of course, affected people have found out about this from the news and not Vastaamo themselves. My heart goes out to the people affected, it takes courage and effort to start working out mental health problems and this has probably been a devastating blow to many.
FDSGSG 6y ago
A Finnish court just ordered a seizure of almost 10 million euros worth of assets from the ex-CEO and his family. Investors believe that he knew about the breach but covered it up, so now they're trying to claw back their money. https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-vastaamon-ex-toimitusjohtaja-ville-tapion-ja-perheenjasenien-omaisuutta-takavarikkoon-liki-10-miljoonan-euron-edesta/7966666 https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-...
- miohtama 6y ago
  This is good developments. Would love to see swift action in the case of data breaches elsewhere.
titzer 6y ago
Yet another instance of "if you're not doing anything wrong, you've got nothing to hide" being a very poor argument against robust privacy protections.
- himinlomax 6y ago
  Excellent point!
- mostlove 6y ago
  "I'm scared that I'll end up like the first 300 people who had all of their info dumped on [anonymity network] Tor, with people going through them, reading everything about their lives and abusing their info for identity thefts." Also another good reason for people not to seek mental help, on top of being able to own a gun. And with the recent rush to transition online, I hope this 2018 hack doesn't give the bad guys any ideas.
  - williamtwild 6y ago
    mostlove said: "Also another good reason for people not to seek mental help," Are you actually advocating that people ignore health issues and not seek help because the way you worded you statement it certainly seems so.
    - johnchristopher 6y ago
      I read it as "that will scare and preveont people who need it to seek mental help".
      - part1of2 6y ago
        I would prefer to make it more personal, like "Im worried my (or my family's) healthcare information would be used against me, that's why we need strong privacy" or "We can all agree that you wouldnt want your child's counselor's notes on the Internet"
    - Retric 6y ago
notRobot 6y ago
Previous discussion, 2 days ago: https://news.ycombinator.com/item?id=24886039 https://news.ycombinator.com/item?id=24886039
adriand 6y ago
This is so insane and so tragic. The anguish these people are going through right now is unconscionable. And the people doing this are truly the scum of the earth. It also raises the question whether certain records just ought not to be digitized, ever. I saw a therapist a few years ago. I asked her at the start, while reviewing her Ts&Cs, about the service she used to store her client data. It was a very secure online service, she assured me. Yeah right, I thought. I asked her to keep my records on paper in her locked filing cabinet instead, and she agreed. I would really recommend the same course of action to anyone.
- amelius 6y ago
  Perhaps they should simply store patients as numbers.
  - biot 6y ago
    That tends to not work very well: https://www.nytimes.com/2006/08/09/technology/09aol.html https://www.nytimes.com/2006/08/09/technology/09aol.html
  - mjevans 6y ago
    That would help, but metadata is a powerful thing. The relations, tendencies, and activities of someone, particularly the kind of notes (I imagine) are kept for therapy subjects, would be a treasure trove even with some subject indirection.
  - jedimastert 6y ago
    Unfortunately you need surprisingly little data to uniquely identify someone. For example, sex, date of birth, and zip code can uniquely identify a large swath of the general public. http://latanyasweeney.org/work/identifiability.html http://latanyasweeney.org/work/identifiability.html
    - srtjstjsj 6y ago
      So removing the unnecessary date of birth and zip code, problem solved.
easytiger 6y ago
Maybe some things should just be kept on paper, at the end of the day.
- deleted 6y ago
  [deleted]
wun0ne 6y ago
Absolutely horrific. I hope those responsible are identified and apprehended as soon as possible.
- mlang23 6y ago
  Identifying the incompetend IT security department responsible for this is likely pretty easy. It is much harder to make the message heard that those in charge of taking care of sensible data are those putting people at risk. How the stuff gets stolen isnt very relevant if it has been stolen. Healthcare data should simply not be allowed to be stored in a way where it can get lost. Period. If the people in charge can not guarantee that, then digital storage needs to be stopped immediately.
  - bencollier49 6y ago
    Agree. Hackers in this case ought to be treated as a force of nature and those responsible for security treated as though they had failed to put adequate "weather protection" in place.
  - deleted 6y ago
    [deleted]
null_object 6y ago
In the interest of accuracy, the title of this post should replace ‘cash’ with ‘Bitcoin’.
- williamtwild 6y ago
  Venmo = digital currency Apple Cash = digital currency ACH = digital currency Direct Deposit = digital currency Bitcoin = Digital currency Credit/Debit Card = digital currency Cash = an annoyance I guess you are trying to make a point but if you don't have your head in the sand cash and bitcoin mean the same.
  - ceejayoz 6y ago
    > if you don't have your head in the sand cash and bitcoin mean the same Not when it comes to blackmailing someone safely from another country. There's a reason ransomware asks for Bitcoin and not cash, credit, Venmo, etc. It's the only non-reversible payment method on your list.
    - williamtwild 6y ago
      "It's the only non-reversible payment method " Cash is non reversible.
      - ceejayoz 6y ago
        > safely from another country Again, there's a reason ransomware doesn't ask for cash. It simply doesn't work for ransomware style attacks; you need an immediate, irreversible payment method that doesn't put the ransomer at significant risk.
        michaelscott 6y ago
        You don't need a cryptocurrency to do that. Things like Western Union payments, gift cards, and (if you're really fancy) running bank payments through multiple jurisdictions have all been used in ransomware attacks. Ransomware has been around a lot longer than Bitcoin.
AnssiH 6y ago
The police have received over 13500 crime reports already, so this may well become the largest Finnish criminal case in history in terms of number of victims (Finnish source: https://www.hs.fi/kotimaa/art-2000006702261.html https://www.hs.fi/kotimaa/art-2000006702261.html). Though I don't think it is yet known how many of those crime reports concern blackmail, unauthorized data release, or other crimes related to the data breach. A couple of English links: https://yle.fi/uutiset/osasto/news/court_freezes_assets_as_vastaamo_probe_looks_for_answers/11616779 https://yle.fi/uutiset/osasto/news/court_freezes_assets_as_v... -- https://yle.fi/uutiset/osasto/news/vastaamo_board_fires_ceo_says_he_kept_data_breach_secret_for_year_and_a_half/11614603 https://yle.fi/uutiset/osasto/news/vastaamo_board_fires_ceo_... -- https://yle.fi/uutiset/osasto/news/president_niinisto_this_affects_all_of_us/11612622 https://yle.fi/uutiset/osasto/news/president_niinisto_this_a... (Yle News) https://www.poliisi.fi/about_the_police/press_releases/1/0/nbi_to_continue_criminal_investigation_into_exceptionally_large-scale_hacking_of_psychotherapy_customer_files_94237 https://www.poliisi.fi/about_the_police/press_releases/1/0/n... (Police) https://tietosuoja.fi/en/-/advice-for-the-victims-of-the-data-leak https://tietosuoja.fi/en/-/advice-for-the-victims-of-the-dat... (Data Protection Ombudsman)
- iflp 6y ago
  From the first two links: > Vastaamo board fires CEO, says he kept [a previous] data breach secret for year and a half > [The CEO's family] owned the company until it was bought by Helsinki-based private equity firm Intera Partners in May 2019, not long after a second breach of the psychotherapy provider’s data security systems.
  - jeltz 6y ago
    So a quite serious GDPR violation then?
    - ptaipale 6y ago
      Yes. And also possibly a rather serious breach of due diligence revelation requirements in the acquisition process, which might constitute either a serious fraud, or specific securities trading crimes that carry penalties of several years in prison. Nearly 10 M€ worth of assets of CEO and his parents have been frozen as a precautionary measure. (Finnish:) https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-vastaamon-ex-toimitusjohtaja-ville-tapion-ja-perheenjasenien-omaisuutta-takavarikkoon-liki-10-miljoonan-euron-edesta/7966666 https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-...
jonplackett 6y ago
> It has set up a helpline and is offering all victims one free therapy session, the details of which will not be recorded. Wow, bet they'll have a lot of takers for that. Maybe they should have thought of this concept earlier.
dbspin 6y ago
I trained as a therapist a decade ago, and even then it was written into my organisational code of ethics that patient notes be stored encrypted with identifying codes rather than names, and the list of name / numbers stored and encrypted separately. While our code of practice didn't specify scheme or location, it's pretty awful that this company didn't seem to have anything in place. But I guess that's to be expected from what sounds like a corporate firm rather than a set of practitioners. At this scale, clients are just numbers on a balance sheet.
- ptaipale 6y ago
  That makes sense, but Finland is a welfare state where government pays for a large part of health care costs, and this data breach was at a start-up that has a couple hundred therapists that mostly contract for the public health care system. And government regulations require tracking of sessions, costs and compensations, identifiable by person ID. One extra piece of anguish people have here is that not only may their mental records be revealed, but simply that their address and person ID is used by identify thiefs who take loans or mail-order things in their name. The government has now responded by starting to find out if the person IDs of the victims could be changed quickly to avoid this risk, but I think that is an answer to wrong question. The right question is why it is permitted to apply for loans with a specific person ID without providing reliable authentication (either electronic signing or physical photo ID).
willvarfar 6y ago
Decades ago one of my first jobs was as an IT bod for a regional health service. One of their facilities was an family psychiatry centre. The staff there refused to let their records be held centrally, and instead had everything on clunky PCs bolted into lockable safes in the corner of each doctor's office. When the safe opened the keyboard slid out. The doctor in charge had also built their own database that they used. Early adopters, before the rest of the health service was modernizing with newfangled computer thingies. Clever people, those doctors.
- heavenlyblue 6y ago
  Another option is to go live in a forest and not use any of the digital tech at all. But that isn’t a smart solution if you’re doing all of this only not to get hacked. PS: let’s say a patient in that clinic wanted to move their history to another clinic. Are they now supposed to pro-rata their surgeon just to get the information from that custom-built database? That is incredibly expensive; and no matter how smart that surgeon is that database is almost certainly not that much more secure than off-the-shelf solution.
  - ChrisMarshallNY 6y ago
    In the US, that's actually the way it works. HIPAA laws are very strict. When I change doctors, I have to go around to all my prior physicians, and get hand-signed releases delivered (if I'm lucky, they will accept a fax). Sometimes, the records are physical papers. I still have all my old MRI and CAT pics (long story).
    - 52-6F-62 6y ago
      With MyChart it's fairly simple to get health care summaries here in Canada (Toronto at least), but I still have to go t through the rigamarole for my images and getting them around to other caretakers. I should have done that last week actually...
      - treeman79 6y ago
salex89 6y ago
A funny piece of advice, I have an actually very good friend (we still are, but at a point in history our relations became a bit dark) who knew that I was going into therapy. I didn't actually accept the fact that I had to go well, and I felt ashamed and weak when we talked about it. Little did he knew, in the meantime I got much better, accepted the fact and started freely speaking about it with other people here and there. Not when not asked, but when the topic of mental health came along, I wasn't shy to expose the fact and encourage people to seek their own. And in one relatively big dispute (minor from this distance), he kind of tried exposing it against me in front of some mutual friends who actually already knew (I told them in the meantime). Well, he looked like massive jackass. In conclusion, don't be ashamed for seeking therapy. Yes, it may feel shameful now, which is completely unwarranted, but a part of the process of healing is also dealing with the existence of the issue itself and taking a different stance at mental health issues. As for the blackmailers... just rot in hell.
- cultus 6y ago
  You must have the forgiveness of a saint to still be friends after something like that. I hope your friend has genuinely changed.
- fredleblanc 6y ago
  My therapist addressed the stigma of therapy in session one: when your arm is broken, you go to a doctor. So why wouldn’t you go to one when your mind is broken? Makes sense to me. Therapy was the best $20 co-pay I paid every week for quite a while. I only stopped because I moved to a state where mental health wasn’t covered well by insurance and couldn’t justify the hourly rate in cash. But it really helped me find perspective in the minutia that is my life. I’d highly recommend it to anyone that can access it. Find a good therapist and give it a go. Also, I second your call for blackmailers to rot. :)
  - metalliqaz 6y ago
    At least in the US where I am, there is a strong stigma attached, and if people know you have mental issues you are assumed to be dangerous. Not surprising, I suppose, in a society that guarantees access to weapons of mass murder. But people won't let you near their kids, and you probably would have trouble finding a job.
apples_oranges 6y ago
Is there a catchy expression for the fact that in the future all data that we believe private will probably be public? Give it a few more security breaches..
- mcbits 6y ago
  I would nominate "data apocalypse" based on the literal meaning of apocalypse (disclosure), but it seems others have already coined the phrase for various other events.
- swebs 6y ago
  https://en.wikipedia.org/wiki/Information_wants_to_be_free https://en.wikipedia.org/wiki/Information_wants_to_be_free
- BMSmnqXAE4yfe1 6y ago
  Even in absence of any security breaches, all currently used encryption is practically assured to be broken with the advances of technology. That LastPass app is so convenient, it stores your passwords in the cloud "securely encrypted". But all your secrets are going to spill in ~50 years.
- srtjstjsj 6y ago
  "privacy is dead" is Mark Zuckerberg's slogan
brador 6y ago
Therapy notes should require both therapist and patient to enter a secret passcode to unlock. 2 person consent.
- deleted 6y ago
  [deleted]
metalliqaz 6y ago
I would sue the clinic into oblivion. The clinic is finished anyway, who would go there now?
- ptaipale 6y ago
  Sueing companies doesn't work quite the same way in Finland as it does in the US, but I am fairly certain that this chain of clinics (which was a 10-year-old start-up with about 250 employees, sold to private equity investor a couple of years ago) is out of business within months. I expect the pieces ("assets") will be picked up by some of the larger private health care providers where the same therapists will continue to contract for the public health care system (it's not the fault of therapists, after all).
greatgib 6y ago
A very good example to show to people that are still in the stupid mindset: "i have nothing to hide because I'm not a criminal"
ExcavateGrandMa 6y ago
AYe karamba!
privacylawthrow 6y ago
There have been previous discussions on HN about why it should be illegal to pay a ransom to hackers. Here is a very good reason why it should not be illegal.
- thatguy0900 6y ago
  Well if it had been made illegal and people stopped paying long ago maybe these hackers wouldn't have bothered since they wouldn't expect a payout. It's only going to get worse as people continue to pay.
- rebuilder 6y ago
  Here I was thinking this is a very good example why paying ransoms should indeed be outlawed. It's a classic case of the individual's short-term interests conflicting with the long-term interests of both society at large and the individual being blackmailed. My main reservation is, I'm not sure how effective a ban on ransom payments would be, in reality.
gonzo41 6y ago
So I don't speak Finnish, but to commit extortion in Finland you probably need to right? Would this mean that the hackers are probably Finnish? And if that's the case, seeing how massive this is for the country. Wouldn't this type of action just be crazy risky for them? Good luck to the cops, I hope they get the bad guys and there's consequences.
- hackerman_fi 6y ago
  The initial post and data dump was on a Finnish TOR-based imageboard but it was written in English. It is still being discussed if the hacker actually is from Finland but uses English to not reveal that. Most Finnish people are fluent in English so it wasn't an issue. The leak was in Finnish mainstream media before the Finnish extortion mails were even sent. When the mails were sent, all hell went loose.
- Tuna-Fish 6y ago
  > So I don't speak Finnish, but to commit extortion in Finland you probably need to right? Reportedly, the extortionists bought translation services from a TOR chan.
  - ptaipale 6y ago
    Sorry, what does "reportedly" mean here? That word is used often in a weasel-like way to make various claims, but is there an actual source for this?
- xorcist 6y ago
  At least some of the threats were reportedly in poor Finnish. Some thinks that is indicative that the extortionists aren't native. You could just as easily make the argument that they're trying to obscure that they are.
b0rsuk 6y ago
Off-topic, but there's one funny thing about psychiatric clinics. Waiting rooms are completely silent. Everywhere else, patients (especially elderly) won't shut up about their pains and treatments.
- watwut 6y ago
  > Everywhere else, patients (especially elderly) won't shut up about their pains and treatments. That is not my experience with clinics at all. People waiting for doctor usually wait silently.
specialist 6y ago
Data at rest must be encrypted. Field level encryption. Just like password files. Salt and hash any potentially identifying information. Translucent Databases shows how. https://www.amazon.com/gp/product/1441421343 https://www.amazon.com/gp/product/1441421343 Source: Created some of the first medical records digital exchanges (NYCLIX, BHIX, etc) in the mid 2000s. Worked very hard to figure out how to protect patient privacy. This breach and subsequent blackmailing was one of our nightmare scenarios. FWIW, nothing (nothing) has improved since.
- yowlingcat 6y ago
  I'm kinda curious about what some of the recent advances in differential privacy in ML could imply in the field here. Taking a look at FB's Opacus, they basically use added noise to ensure that the data "in transit" is not really the data "at rest" and I've toyed with the idea of storing working data and data at rest differently for sensitive information, with the latter being encrypted by a user's OTP so an operator breach cannot effectively do much. The problem with this approach is the question "how much noise?" Too little and an adversarial attacker can do some kind of a regression based attack. Too much and the "anonymized" data fails to be a useful "substitute" for previous analysis/business logic previously operating on the raw data. There's also the whole field of homomorphic encryption to get into as well. It looks like there have been some interesting breakthroughs there from the crypto nut side, specifically with zk-snarks. I can't say I understand the underlying tech well enough to comment, though. Fascinating subject. [1] https://ai.facebook.com/blog/introducing-opacus-a-high-speed-library-for-training-pytorch-models-with-differential-privacy/ https://ai.facebook.com/blog/introducing-opacus-a-high-speed...
  - specialist 6y ago
    Thanks. Learning zero knowledge is on my to do list. I'm skeptical of differential privacy for patient medical records. I assume big data style deanon wins once you can correlate with other data. Differential privacy is probably fine for "data dumps", like when study data is extracted from many patients. Since those dumps are not used for ongoing care, they can be more aggressively scrubbed. Total aside: Even encrypting data at rest is insufficient. Because even preserving chronological order (no timestamps) is sufficient for deanon. But last week I had a new notion for hiding time and order. I am a total crypto noob, so I'm still trying to figure out if this is a new idea. As a defender of patient and voter privacy, and so therefore a very vocal critic of electronic voting, I will be deeply chagrinned if I figure out how to make it work.
fritzo 6y ago
Call to action for neural artists: We need deep fakes to generate vast amounts of plausible noise and thereby conceal our sensitive private signal. I feel like the only way our species will regain a sense of privacy is when we're concealed in a forest of artificial signal.
- marcinzm 6y ago
  Wasn't that a plot point in Rainbow's End where in the future the internet is filled with fake personal information to the point of googling someone is pointless.
  - fritzo 6y ago
    Thanks, I hadn't heard of Rainbow's End!
amelius 6y ago
Another crime partially made possible by Bitcoin. This doesn't necessarily make Bitcoin or other cryptocurrencies "bad", but we should keep a score of the advantages and disadvantages of a technology.
- EGreg 6y ago
  Yes agreed. Every technology has downsides. This isn’t just limited to Bitcoin. It applies to encryption and privacy in general. Should people be allowed to permissionlessly create accounts on networks, and have private communications in which they can organize large activities or effect large value transfers, or should we as a society go after every such network to shut it down?

246 points by velmu 6y ago

Apparent timeline: 2018 Nov: Company breached, seems most likely database of 40,000 mental health records including PII (duh), contact information and treatment history and notes was stolen at this time. 2019 Mar: Another breach. This causes Vastaamo to increase security and close the holes the hackers used. 2019 Apr/May: Independent security company (not named) performs audit since the company was to be sold. Some improvements were suggested, no major security flaws were found. 2020 Aug/Sep: Vastaamo receives threat from hacker if they will not pay 40BTC the hacker will release the database. Until they do the hacker will release 100 records per day. 2020 Sep/Oct: Infosec company Nixu researches Vastaamo systems, reporting that the breach that stole the database was probably made in November 2018, possibly single records in subsequent breaches. 2020 Oct: Individuals whose information was not in the already-leaked records have been contacted and extorted individually. After that, in no particular order: * 300 records have been leaked. The hacker seems to have stopped, though. * Single records not included in the 400 have surfaced on TOR web * A site on TOR was up for a while with several similarly-named files, one a 10GB tar that is rumored to be database. Partial downloads have been reported. Edit: Also program snippets etc included, with possible 'digital fingerprint' according to Mikko Hyppönen, a well-known Finnish security expert. * An IP address related to the hack has been traced to Inkoo, Finland. CEO claims the 2020 Nixu report was the first time he heard of the breaches and that's why the new CEO or board were not informed -- which seems awfully sus, considering several breaches were made and a reactionary battering down the hatches as well as an external audit were made. Further, people who work or used to work at Vastaamo have come out claiming toxic work environment, threats of lawsuits if they speak out against the company, bad working conditions and a large number of ethical violations (like using as advertisement names and reputation of people who don't work for them). It also appears they've been sending social security numbers in plaintext over email. Claims have also been made that the database and system were outdated and only had default passwords and no real attempt at securing the data or even servers have been made, but of course nothing is public yet. Possibly never will be. All in all, looks like the previous owner is a bona fide scumbag with all the bells and whistles that entail. And, of course as is fashionable, when asked about these things his responses have been "I have no knowledge of that" and "I do not recall." And, of course, affected people have found out about this from the news and not Vastaamo themselves. My heart goes out to the people affected, it takes courage and effort to start working out mental health problems and this has probably been a devastating blow to many.

FDSGSG 6y ago

A Finnish court just ordered a seizure of almost 10 million euros worth of assets from the ex-CEO and his family. Investors believe that he knew about the breach but covered it up, so now they're trying to claw back their money. https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-vastaamon-ex-toimitusjohtaja-ville-tapion-ja-perheenjasenien-omaisuutta-takavarikkoon-liki-10-miljoonan-euron-edesta/7966666 https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-...

miohtama 6y ago
This is good developments. Would love to see swift action in the case of data breaches elsewhere.

titzer 6y ago

Yet another instance of "if you're not doing anything wrong, you've got nothing to hide" being a very poor argument against robust privacy protections.

himinlomax 6y ago
Excellent point!
mostlove 6y ago
"I'm scared that I'll end up like the first 300 people who had all of their info dumped on [anonymity network] Tor, with people going through them, reading everything about their lives and abusing their info for identity thefts." Also another good reason for people not to seek mental help, on top of being able to own a gun. And with the recent rush to transition online, I hope this 2018 hack doesn't give the bad guys any ideas.
- williamtwild 6y ago
  mostlove said: "Also another good reason for people not to seek mental help," Are you actually advocating that people ignore health issues and not seek help because the way you worded you statement it certainly seems so.
  - johnchristopher 6y ago
    I read it as "that will scare and preveont people who need it to seek mental help".
    - part1of2 6y ago
      I would prefer to make it more personal, like "Im worried my (or my family's) healthcare information would be used against me, that's why we need strong privacy" or "We can all agree that you wouldnt want your child's counselor's notes on the Internet"
  - Retric 6y ago

notRobot 6y ago

Previous discussion, 2 days ago: https://news.ycombinator.com/item?id=24886039 https://news.ycombinator.com/item?id=24886039

adriand 6y ago

This is so insane and so tragic. The anguish these people are going through right now is unconscionable. And the people doing this are truly the scum of the earth. It also raises the question whether certain records just ought not to be digitized, ever. I saw a therapist a few years ago. I asked her at the start, while reviewing her Ts&Cs, about the service she used to store her client data. It was a very secure online service, she assured me. Yeah right, I thought. I asked her to keep my records on paper in her locked filing cabinet instead, and she agreed. I would really recommend the same course of action to anyone.

amelius 6y ago
Perhaps they should simply store patients as numbers.
- biot 6y ago
  That tends to not work very well: https://www.nytimes.com/2006/08/09/technology/09aol.html https://www.nytimes.com/2006/08/09/technology/09aol.html
- mjevans 6y ago
  That would help, but metadata is a powerful thing. The relations, tendencies, and activities of someone, particularly the kind of notes (I imagine) are kept for therapy subjects, would be a treasure trove even with some subject indirection.
- jedimastert 6y ago
  Unfortunately you need surprisingly little data to uniquely identify someone. For example, sex, date of birth, and zip code can uniquely identify a large swath of the general public. http://latanyasweeney.org/work/identifiability.html http://latanyasweeney.org/work/identifiability.html
  - srtjstjsj 6y ago
    So removing the unnecessary date of birth and zip code, problem solved.

easytiger 6y ago

Maybe some things should just be kept on paper, at the end of the day.

deleted 6y ago
[deleted]

wun0ne 6y ago

Absolutely horrific. I hope those responsible are identified and apprehended as soon as possible.

mlang23 6y ago
Identifying the incompetend IT security department responsible for this is likely pretty easy. It is much harder to make the message heard that those in charge of taking care of sensible data are those putting people at risk. How the stuff gets stolen isnt very relevant if it has been stolen. Healthcare data should simply not be allowed to be stored in a way where it can get lost. Period. If the people in charge can not guarantee that, then digital storage needs to be stopped immediately.
- bencollier49 6y ago
  Agree. Hackers in this case ought to be treated as a force of nature and those responsible for security treated as though they had failed to put adequate "weather protection" in place.
- deleted 6y ago
  [deleted]

null_object 6y ago

In the interest of accuracy, the title of this post should replace ‘cash’ with ‘Bitcoin’.

williamtwild 6y ago
Venmo = digital currency Apple Cash = digital currency ACH = digital currency Direct Deposit = digital currency Bitcoin = Digital currency Credit/Debit Card = digital currency Cash = an annoyance I guess you are trying to make a point but if you don't have your head in the sand cash and bitcoin mean the same.
- ceejayoz 6y ago
  > if you don't have your head in the sand cash and bitcoin mean the same Not when it comes to blackmailing someone safely from another country. There's a reason ransomware asks for Bitcoin and not cash, credit, Venmo, etc. It's the only non-reversible payment method on your list.
  - williamtwild 6y ago
    "It's the only non-reversible payment method " Cash is non reversible.
    - ceejayoz 6y ago
      > safely from another country Again, there's a reason ransomware doesn't ask for cash. It simply doesn't work for ransomware style attacks; you need an immediate, irreversible payment method that doesn't put the ransomer at significant risk.
      - michaelscott 6y ago
        You don't need a cryptocurrency to do that. Things like Western Union payments, gift cards, and (if you're really fancy) running bank payments through multiple jurisdictions have all been used in ransomware attacks. Ransomware has been around a lot longer than Bitcoin.

AnssiH 6y ago

The police have received over 13500 crime reports already, so this may well become the largest Finnish criminal case in history in terms of number of victims (Finnish source: https://www.hs.fi/kotimaa/art-2000006702261.html https://www.hs.fi/kotimaa/art-2000006702261.html). Though I don't think it is yet known how many of those crime reports concern blackmail, unauthorized data release, or other crimes related to the data breach. A couple of English links: https://yle.fi/uutiset/osasto/news/court_freezes_assets_as_vastaamo_probe_looks_for_answers/11616779 https://yle.fi/uutiset/osasto/news/court_freezes_assets_as_v... -- https://yle.fi/uutiset/osasto/news/vastaamo_board_fires_ceo_says_he_kept_data_breach_secret_for_year_and_a_half/11614603 https://yle.fi/uutiset/osasto/news/vastaamo_board_fires_ceo_... -- https://yle.fi/uutiset/osasto/news/president_niinisto_this_affects_all_of_us/11612622 https://yle.fi/uutiset/osasto/news/president_niinisto_this_a... (Yle News) https://www.poliisi.fi/about_the_police/press_releases/1/0/nbi_to_continue_criminal_investigation_into_exceptionally_large-scale_hacking_of_psychotherapy_customer_files_94237 https://www.poliisi.fi/about_the_police/press_releases/1/0/n... (Police) https://tietosuoja.fi/en/-/advice-for-the-victims-of-the-data-leak https://tietosuoja.fi/en/-/advice-for-the-victims-of-the-dat... (Data Protection Ombudsman)

iflp 6y ago
From the first two links: > Vastaamo board fires CEO, says he kept [a previous] data breach secret for year and a half > [The CEO's family] owned the company until it was bought by Helsinki-based private equity firm Intera Partners in May 2019, not long after a second breach of the psychotherapy provider’s data security systems.
- jeltz 6y ago
  So a quite serious GDPR violation then?
  - ptaipale 6y ago
    Yes. And also possibly a rather serious breach of due diligence revelation requirements in the acquisition process, which might constitute either a serious fraud, or specific securities trading crimes that carry penalties of several years in prison. Nearly 10 M€ worth of assets of CEO and his parents have been frozen as a precautionary measure. (Finnish:) https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-vastaamon-ex-toimitusjohtaja-ville-tapion-ja-perheenjasenien-omaisuutta-takavarikkoon-liki-10-miljoonan-euron-edesta/7966666 https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-...

jonplackett 6y ago

> It has set up a helpline and is offering all victims one free therapy session, the details of which will not be recorded. Wow, bet they'll have a lot of takers for that. Maybe they should have thought of this concept earlier.

dbspin 6y ago

I trained as a therapist a decade ago, and even then it was written into my organisational code of ethics that patient notes be stored encrypted with identifying codes rather than names, and the list of name / numbers stored and encrypted separately. While our code of practice didn't specify scheme or location, it's pretty awful that this company didn't seem to have anything in place. But I guess that's to be expected from what sounds like a corporate firm rather than a set of practitioners. At this scale, clients are just numbers on a balance sheet.

ptaipale 6y ago
That makes sense, but Finland is a welfare state where government pays for a large part of health care costs, and this data breach was at a start-up that has a couple hundred therapists that mostly contract for the public health care system. And government regulations require tracking of sessions, costs and compensations, identifiable by person ID. One extra piece of anguish people have here is that not only may their mental records be revealed, but simply that their address and person ID is used by identify thiefs who take loans or mail-order things in their name. The government has now responded by starting to find out if the person IDs of the victims could be changed quickly to avoid this risk, but I think that is an answer to wrong question. The right question is why it is permitted to apply for loans with a specific person ID without providing reliable authentication (either electronic signing or physical photo ID).

willvarfar 6y ago

Decades ago one of my first jobs was as an IT bod for a regional health service. One of their facilities was an family psychiatry centre. The staff there refused to let their records be held centrally, and instead had everything on clunky PCs bolted into lockable safes in the corner of each doctor's office. When the safe opened the keyboard slid out. The doctor in charge had also built their own database that they used. Early adopters, before the rest of the health service was modernizing with newfangled computer thingies. Clever people, those doctors.

heavenlyblue 6y ago
Another option is to go live in a forest and not use any of the digital tech at all. But that isn’t a smart solution if you’re doing all of this only not to get hacked. PS: let’s say a patient in that clinic wanted to move their history to another clinic. Are they now supposed to pro-rata their surgeon just to get the information from that custom-built database? That is incredibly expensive; and no matter how smart that surgeon is that database is almost certainly not that much more secure than off-the-shelf solution.
- ChrisMarshallNY 6y ago
  In the US, that's actually the way it works. HIPAA laws are very strict. When I change doctors, I have to go around to all my prior physicians, and get hand-signed releases delivered (if I'm lucky, they will accept a fax). Sometimes, the records are physical papers. I still have all my old MRI and CAT pics (long story).
  - 52-6F-62 6y ago
    With MyChart it's fairly simple to get health care summaries here in Canada (Toronto at least), but I still have to go t through the rigamarole for my images and getting them around to other caretakers. I should have done that last week actually...
    - treeman79 6y ago

salex89 6y ago

A funny piece of advice, I have an actually very good friend (we still are, but at a point in history our relations became a bit dark) who knew that I was going into therapy. I didn't actually accept the fact that I had to go well, and I felt ashamed and weak when we talked about it. Little did he knew, in the meantime I got much better, accepted the fact and started freely speaking about it with other people here and there. Not when not asked, but when the topic of mental health came along, I wasn't shy to expose the fact and encourage people to seek their own. And in one relatively big dispute (minor from this distance), he kind of tried exposing it against me in front of some mutual friends who actually already knew (I told them in the meantime). Well, he looked like massive jackass. In conclusion, don't be ashamed for seeking therapy. Yes, it may feel shameful now, which is completely unwarranted, but a part of the process of healing is also dealing with the existence of the issue itself and taking a different stance at mental health issues. As for the blackmailers... just rot in hell.

cultus 6y ago
You must have the forgiveness of a saint to still be friends after something like that. I hope your friend has genuinely changed.
fredleblanc 6y ago
My therapist addressed the stigma of therapy in session one: when your arm is broken, you go to a doctor. So why wouldn’t you go to one when your mind is broken? Makes sense to me. Therapy was the best $20 co-pay I paid every week for quite a while. I only stopped because I moved to a state where mental health wasn’t covered well by insurance and couldn’t justify the hourly rate in cash. But it really helped me find perspective in the minutia that is my life. I’d highly recommend it to anyone that can access it. Find a good therapist and give it a go. Also, I second your call for blackmailers to rot. :)
- metalliqaz 6y ago
  At least in the US where I am, there is a strong stigma attached, and if people know you have mental issues you are assumed to be dangerous. Not surprising, I suppose, in a society that guarantees access to weapons of mass murder. But people won't let you near their kids, and you probably would have trouble finding a job.

apples_oranges 6y ago

Is there a catchy expression for the fact that in the future all data that we believe private will probably be public? Give it a few more security breaches..

mcbits 6y ago
I would nominate "data apocalypse" based on the literal meaning of apocalypse (disclosure), but it seems others have already coined the phrase for various other events.
swebs 6y ago
https://en.wikipedia.org/wiki/Information_wants_to_be_free https://en.wikipedia.org/wiki/Information_wants_to_be_free
BMSmnqXAE4yfe1 6y ago
Even in absence of any security breaches, all currently used encryption is practically assured to be broken with the advances of technology. That LastPass app is so convenient, it stores your passwords in the cloud "securely encrypted". But all your secrets are going to spill in ~50 years.
srtjstjsj 6y ago
"privacy is dead" is Mark Zuckerberg's slogan

brador 6y ago

Therapy notes should require both therapist and patient to enter a secret passcode to unlock. 2 person consent.

deleted 6y ago
[deleted]

metalliqaz 6y ago

I would sue the clinic into oblivion. The clinic is finished anyway, who would go there now?

ptaipale 6y ago
Sueing companies doesn't work quite the same way in Finland as it does in the US, but I am fairly certain that this chain of clinics (which was a 10-year-old start-up with about 250 employees, sold to private equity investor a couple of years ago) is out of business within months. I expect the pieces ("assets") will be picked up by some of the larger private health care providers where the same therapists will continue to contract for the public health care system (it's not the fault of therapists, after all).

greatgib 6y ago

A very good example to show to people that are still in the stupid mindset: "i have nothing to hide because I'm not a criminal"

ExcavateGrandMa 6y ago

AYe karamba!

privacylawthrow 6y ago

There have been previous discussions on HN about why it should be illegal to pay a ransom to hackers. Here is a very good reason why it should not be illegal.

thatguy0900 6y ago
Well if it had been made illegal and people stopped paying long ago maybe these hackers wouldn't have bothered since they wouldn't expect a payout. It's only going to get worse as people continue to pay.
rebuilder 6y ago
Here I was thinking this is a very good example why paying ransoms should indeed be outlawed. It's a classic case of the individual's short-term interests conflicting with the long-term interests of both society at large and the individual being blackmailed. My main reservation is, I'm not sure how effective a ban on ransom payments would be, in reality.

gonzo41 6y ago

So I don't speak Finnish, but to commit extortion in Finland you probably need to right? Would this mean that the hackers are probably Finnish? And if that's the case, seeing how massive this is for the country. Wouldn't this type of action just be crazy risky for them? Good luck to the cops, I hope they get the bad guys and there's consequences.

hackerman_fi 6y ago
The initial post and data dump was on a Finnish TOR-based imageboard but it was written in English. It is still being discussed if the hacker actually is from Finland but uses English to not reveal that. Most Finnish people are fluent in English so it wasn't an issue. The leak was in Finnish mainstream media before the Finnish extortion mails were even sent. When the mails were sent, all hell went loose.
Tuna-Fish 6y ago
> So I don't speak Finnish, but to commit extortion in Finland you probably need to right? Reportedly, the extortionists bought translation services from a TOR chan.
- ptaipale 6y ago
  Sorry, what does "reportedly" mean here? That word is used often in a weasel-like way to make various claims, but is there an actual source for this?
xorcist 6y ago
At least some of the threats were reportedly in poor Finnish. Some thinks that is indicative that the extortionists aren't native. You could just as easily make the argument that they're trying to obscure that they are.

b0rsuk 6y ago

Off-topic, but there's one funny thing about psychiatric clinics. Waiting rooms are completely silent. Everywhere else, patients (especially elderly) won't shut up about their pains and treatments.

watwut 6y ago
> Everywhere else, patients (especially elderly) won't shut up about their pains and treatments. That is not my experience with clinics at all. People waiting for doctor usually wait silently.

specialist 6y ago

Data at rest must be encrypted. Field level encryption. Just like password files. Salt and hash any potentially identifying information. Translucent Databases shows how. https://www.amazon.com/gp/product/1441421343 https://www.amazon.com/gp/product/1441421343 Source: Created some of the first medical records digital exchanges (NYCLIX, BHIX, etc) in the mid 2000s. Worked very hard to figure out how to protect patient privacy. This breach and subsequent blackmailing was one of our nightmare scenarios. FWIW, nothing (nothing) has improved since.

yowlingcat 6y ago
I'm kinda curious about what some of the recent advances in differential privacy in ML could imply in the field here. Taking a look at FB's Opacus, they basically use added noise to ensure that the data "in transit" is not really the data "at rest" and I've toyed with the idea of storing working data and data at rest differently for sensitive information, with the latter being encrypted by a user's OTP so an operator breach cannot effectively do much. The problem with this approach is the question "how much noise?" Too little and an adversarial attacker can do some kind of a regression based attack. Too much and the "anonymized" data fails to be a useful "substitute" for previous analysis/business logic previously operating on the raw data. There's also the whole field of homomorphic encryption to get into as well. It looks like there have been some interesting breakthroughs there from the crypto nut side, specifically with zk-snarks. I can't say I understand the underlying tech well enough to comment, though. Fascinating subject. [1] https://ai.facebook.com/blog/introducing-opacus-a-high-speed-library-for-training-pytorch-models-with-differential-privacy/ https://ai.facebook.com/blog/introducing-opacus-a-high-speed...
- specialist 6y ago
  Thanks. Learning zero knowledge is on my to do list. I'm skeptical of differential privacy for patient medical records. I assume big data style deanon wins once you can correlate with other data. Differential privacy is probably fine for "data dumps", like when study data is extracted from many patients. Since those dumps are not used for ongoing care, they can be more aggressively scrubbed. Total aside: Even encrypting data at rest is insufficient. Because even preserving chronological order (no timestamps) is sufficient for deanon. But last week I had a new notion for hiding time and order. I am a total crypto noob, so I'm still trying to figure out if this is a new idea. As a defender of patient and voter privacy, and so therefore a very vocal critic of electronic voting, I will be deeply chagrinned if I figure out how to make it work.

fritzo 6y ago

Call to action for neural artists: We need deep fakes to generate vast amounts of plausible noise and thereby conceal our sensitive private signal. I feel like the only way our species will regain a sense of privacy is when we're concealed in a forest of artificial signal.

marcinzm 6y ago
Wasn't that a plot point in Rainbow's End where in the future the internet is filled with fake personal information to the point of googling someone is pointless.
- fritzo 6y ago
  Thanks, I hadn't heard of Rainbow's End!

amelius 6y ago

Another crime partially made possible by Bitcoin. This doesn't necessarily make Bitcoin or other cryptocurrencies "bad", but we should keep a score of the advantages and disadvantages of a technology.

EGreg 6y ago
Yes agreed. Every technology has downsides. This isn’t just limited to Bitcoin. It applies to encryption and privacy in general. Should people be allowed to permissionlessly create accounts on networks, and have private communications in which they can organize large activities or effect large value transfers, or should we as a society go after every such network to shut it down?