5 ms·

The police have received over 13500 crime reports already, so this may well become the largest Finnish criminal case in history in terms of number of victims (F

by AnssiH 6y ago

The police have received over 13500 crime reports already, so this may well become the largest Finnish criminal case in history in terms of number of victims (Finnish source: https://www.hs.fi/kotimaa/art-2000006702261.html https://www.hs.fi/kotimaa/art-2000006702261.html). Though I don't think it is yet known how many of those crime reports concern blackmail, unauthorized data release, or other crimes related to the data breach. A couple of English links: https://yle.fi/uutiset/osasto/news/court_freezes_assets_as_vastaamo_probe_looks_for_answers/11616779 https://yle.fi/uutiset/osasto/news/court_freezes_assets_as_v... -- https://yle.fi/uutiset/osasto/news/vastaamo_board_fires_ceo_says_he_kept_data_breach_secret_for_year_and_a_half/11614603 https://yle.fi/uutiset/osasto/news/vastaamo_board_fires_ceo_... -- https://yle.fi/uutiset/osasto/news/president_niinisto_this_affects_all_of_us/11612622 https://yle.fi/uutiset/osasto/news/president_niinisto_this_a... (Yle News) https://www.poliisi.fi/about_the_police/press_releases/1/0/nbi_to_continue_criminal_investigation_into_exceptionally_large-scale_hacking_of_psychotherapy_customer_files_94237 https://www.poliisi.fi/about_the_police/press_releases/1/0/n... (Police) https://tietosuoja.fi/en/-/advice-for-the-victims-of-the-data-leak https://tietosuoja.fi/en/-/advice-for-the-victims-of-the-dat... (Data Protection Ombudsman)

iflp 6y ago
From the first two links: > Vastaamo board fires CEO, says he kept [a previous] data breach secret for year and a half > [The CEO's family] owned the company until it was bought by Helsinki-based private equity firm Intera Partners in May 2019, not long after a second breach of the psychotherapy provider’s data security systems.
- jeltz 6y ago
  So a quite serious GDPR violation then?
  - ptaipale 6y ago
    Yes. And also possibly a rather serious breach of due diligence revelation requirements in the acquisition process, which might constitute either a serious fraud, or specific securities trading crimes that carry penalties of several years in prison. Nearly 10 M€ worth of assets of CEO and his parents have been frozen as a precautionary measure. (Finnish:) https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-vastaamon-ex-toimitusjohtaja-ville-tapion-ja-perheenjasenien-omaisuutta-takavarikkoon-liki-10-miljoonan-euron-edesta/7966666 https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-...
  - hackerman_fi 6y ago
    According to the hacker (messages with tripcode on TOR imageboard) the DB was using a public IP and he gained access with root:root credentials.
    - k4rli 6y ago
      "What are the odds of somebody finding our database IP out of 4.29 billion IPv4 addresses?"
      - ducktective 6y ago
        Seriously, what are the odds?
      - snvzz 6y ago
        About p=1. It's more of a question of how many seconds it would take for it to happen.
    - ptaipale 6y ago
      However, we cannot really know if that was the case. We have no guarantee that the message board poster even is the person behind the blackmail, and moreover, even if it is, this might be just about muddying the waters to cover what actually happend - for instance, if it was an old-fashioned stealing of data by a disgruntled employee. Let the police investigation find out.
- gonzo41 6y ago
  Ahh private equity, is there anything it won't wreck.
  - reader_mode 6y ago
    Am I reading the parent comment wrong or did the breaches happen before PE takeover ?
    - rendall 6y ago
      If I myself understand correctly, there was a previous breach that the CEO covered up in advance of the takeover, which is being viewed as potential fraud
  - jjoonathan 6y ago
    To be fair, it doesn't actually wreck the company, it just front-runs other vultures by selling a bullshit turnaround narrative to obtain management status and get first pickings. It's the white collar equivalent of walking out the door of a dying company with the chairs and coffee machine -- so, naturally, a thousand times more destructive and a thousand times less illegal.
    - deleted 6y ago
      [deleted]
    - KajMagnus 6y ago
      Sounds as if private equity firms that buy a startup, often cause damage to the startup? How does that work? I don't totally understand the chairs and coffee machine analogy > selling a bullshit turnaround narrative Does that mean that the PE firms pretend the startups are doing a lot better, than what they actually are? So that the PE firm gets to sell the starup to someone else who pays "a lot too much" money? > to obtain management status and get first pickings What does that mean? A PE firm having management status? I'm thinking individual people have management status does it mean that the PE firm appoints some of its own people as managers / CEX:es?

by AnssiH 6y ago

iflp 6y ago

From the first two links: > Vastaamo board fires CEO, says he kept [a previous] data breach secret for year and a half > [The CEO's family] owned the company until it was bought by Helsinki-based private equity firm Intera Partners in May 2019, not long after a second breach of the psychotherapy provider’s data security systems.

jeltz 6y ago
So a quite serious GDPR violation then?
- ptaipale 6y ago
  Yes. And also possibly a rather serious breach of due diligence revelation requirements in the acquisition process, which might constitute either a serious fraud, or specific securities trading crimes that carry penalties of several years in prison. Nearly 10 M€ worth of assets of CEO and his parents have been frozen as a precautionary measure. (Finnish:) https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-vastaamon-ex-toimitusjohtaja-ville-tapion-ja-perheenjasenien-omaisuutta-takavarikkoon-liki-10-miljoonan-euron-edesta/7966666 https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-...
- hackerman_fi 6y ago
  According to the hacker (messages with tripcode on TOR imageboard) the DB was using a public IP and he gained access with root:root credentials.
  - k4rli 6y ago
    "What are the odds of somebody finding our database IP out of 4.29 billion IPv4 addresses?"
    - ducktective 6y ago
      Seriously, what are the odds?
    - snvzz 6y ago
      About p=1. It's more of a question of how many seconds it would take for it to happen.
  - ptaipale 6y ago
    However, we cannot really know if that was the case. We have no guarantee that the message board poster even is the person behind the blackmail, and moreover, even if it is, this might be just about muddying the waters to cover what actually happend - for instance, if it was an old-fashioned stealing of data by a disgruntled employee. Let the police investigation find out.
gonzo41 6y ago
Ahh private equity, is there anything it won't wreck.
- reader_mode 6y ago
  Am I reading the parent comment wrong or did the breaches happen before PE takeover ?
  - rendall 6y ago
    If I myself understand correctly, there was a previous breach that the CEO covered up in advance of the takeover, which is being viewed as potential fraud
- jjoonathan 6y ago
  To be fair, it doesn't actually wreck the company, it just front-runs other vultures by selling a bullshit turnaround narrative to obtain management status and get first pickings. It's the white collar equivalent of walking out the door of a dying company with the chairs and coffee machine -- so, naturally, a thousand times more destructive and a thousand times less illegal.
  - deleted 6y ago
    [deleted]
  - KajMagnus 6y ago
    Sounds as if private equity firms that buy a startup, often cause damage to the startup? How does that work? I don't totally understand the chairs and coffee machine analogy > selling a bullshit turnaround narrative Does that mean that the PE firms pretend the startups are doing a lot better, than what they actually are? So that the PE firm gets to sell the starup to someone else who pays "a lot too much" money? > to obtain management status and get first pickings What does that mean? A PE firm having management status? I'm thinking individual people have management status does it mean that the PE firm appoints some of its own people as managers / CEX:es?