4 ms·

From the first two links: > Vastaamo board fires CEO, says he kept [a previous] data breach secret for year and a half > [The CEO's family] owned the company

by iflp 6y ago

From the first two links: > Vastaamo board fires CEO, says he kept [a previous] data breach secret for year and a half > [The CEO's family] owned the company until it was bought by Helsinki-based private equity firm Intera Partners in May 2019, not long after a second breach of the psychotherapy provider’s data security systems.

jeltz 6y ago
So a quite serious GDPR violation then?
- ptaipale 6y ago
  Yes. And also possibly a rather serious breach of due diligence revelation requirements in the acquisition process, which might constitute either a serious fraud, or specific securities trading crimes that carry penalties of several years in prison. Nearly 10 M€ worth of assets of CEO and his parents have been frozen as a precautionary measure. (Finnish:) https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-vastaamon-ex-toimitusjohtaja-ville-tapion-ja-perheenjasenien-omaisuutta-takavarikkoon-liki-10-miljoonan-euron-edesta/7966666 https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-...
- hackerman_fi 6y ago
  According to the hacker (messages with tripcode on TOR imageboard) the DB was using a public IP and he gained access with root:root credentials.
  - k4rli 6y ago
    "What are the odds of somebody finding our database IP out of 4.29 billion IPv4 addresses?"
    - ducktective 6y ago
      Seriously, what are the odds?
    - snvzz 6y ago
      About p=1. It's more of a question of how many seconds it would take for it to happen.
  - ptaipale 6y ago
    However, we cannot really know if that was the case. We have no guarantee that the message board poster even is the person behind the blackmail, and moreover, even if it is, this might be just about muddying the waters to cover what actually happend - for instance, if it was an old-fashioned stealing of data by a disgruntled employee. Let the police investigation find out.
gonzo41 6y ago
Ahh private equity, is there anything it won't wreck.
- reader_mode 6y ago
  Am I reading the parent comment wrong or did the breaches happen before PE takeover ?
  - rendall 6y ago
    If I myself understand correctly, there was a previous breach that the CEO covered up in advance of the takeover, which is being viewed as potential fraud
- jjoonathan 6y ago
  To be fair, it doesn't actually wreck the company, it just front-runs other vultures by selling a bullshit turnaround narrative to obtain management status and get first pickings. It's the white collar equivalent of walking out the door of a dying company with the chairs and coffee machine -- so, naturally, a thousand times more destructive and a thousand times less illegal.
  - deleted 6y ago
    [deleted]
  - KajMagnus 6y ago
    Sounds as if private equity firms that buy a startup, often cause damage to the startup? How does that work? I don't totally understand the chairs and coffee machine analogy > selling a bullshit turnaround narrative Does that mean that the PE firms pretend the startups are doing a lot better, than what they actually are? So that the PE firm gets to sell the starup to someone else who pays "a lot too much" money? > to obtain management status and get first pickings What does that mean? A PE firm having management status? I'm thinking individual people have management status does it mean that the PE firm appoints some of its own people as managers / CEX:es?

by iflp 6y ago

jeltz 6y ago

So a quite serious GDPR violation then?

ptaipale 6y ago
Yes. And also possibly a rather serious breach of due diligence revelation requirements in the acquisition process, which might constitute either a serious fraud, or specific securities trading crimes that carry penalties of several years in prison. Nearly 10 M€ worth of assets of CEO and his parents have been frozen as a precautionary measure. (Finnish:) https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-vastaamon-ex-toimitusjohtaja-ville-tapion-ja-perheenjasenien-omaisuutta-takavarikkoon-liki-10-miljoonan-euron-edesta/7966666 https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-...
hackerman_fi 6y ago
According to the hacker (messages with tripcode on TOR imageboard) the DB was using a public IP and he gained access with root:root credentials.
- k4rli 6y ago
  "What are the odds of somebody finding our database IP out of 4.29 billion IPv4 addresses?"
  - ducktective 6y ago
    Seriously, what are the odds?
  - snvzz 6y ago
    About p=1. It's more of a question of how many seconds it would take for it to happen.
- ptaipale 6y ago
  However, we cannot really know if that was the case. We have no guarantee that the message board poster even is the person behind the blackmail, and moreover, even if it is, this might be just about muddying the waters to cover what actually happend - for instance, if it was an old-fashioned stealing of data by a disgruntled employee. Let the police investigation find out.

gonzo41 6y ago

Ahh private equity, is there anything it won't wreck.

reader_mode 6y ago
Am I reading the parent comment wrong or did the breaches happen before PE takeover ?
- rendall 6y ago
  If I myself understand correctly, there was a previous breach that the CEO covered up in advance of the takeover, which is being viewed as potential fraud
jjoonathan 6y ago
To be fair, it doesn't actually wreck the company, it just front-runs other vultures by selling a bullshit turnaround narrative to obtain management status and get first pickings. It's the white collar equivalent of walking out the door of a dying company with the chairs and coffee machine -- so, naturally, a thousand times more destructive and a thousand times less illegal.
- deleted 6y ago
  [deleted]
- KajMagnus 6y ago
  Sounds as if private equity firms that buy a startup, often cause damage to the startup? How does that work? I don't totally understand the chairs and coffee machine analogy > selling a bullshit turnaround narrative Does that mean that the PE firms pretend the startups are doing a lot better, than what they actually are? So that the PE firm gets to sell the starup to someone else who pays "a lot too much" money? > to obtain management status and get first pickings What does that mean? A PE firm having management status? I'm thinking individual people have management status does it mean that the PE firm appoints some of its own people as managers / CEX:es?