Finland Issues Wanted Notice for Vastaamo Hacker Kivimäki

Finland's Supreme Court has closed the door on one of the country's ugliest cybercrime cases. It refused to hear Aleksanteri Kivimäki's appeal, leaving a February ruling from the Court of Appeal intact: nearly seven years in prison for hacking the psychotherapy provider Vastaamo and extorting both the company and its patients.

There is a snag. Kivimäki is not in custody. His lawyer, Peter Jaari, has told Finnish media he does not know where his client is, but suspects he is somewhere outside Finland. Eastern Uusimaa Police have issued a wanted notice at the request of the Criminal Sanctions Agency, with instructions to arrest him on sight and deliver him to Vantaa Prison.

How he walked out the door

He was free to disappear because the appeals court released him from pretrial detention in September 2025, ruling that he had already served enough time in custody while awaiting trial. Most of the sentence, by that reckoning, was already behind him. The remainder is now the subject of a manhunt.

It is an awkward look for a case that Finnish authorities have treated as one of the most serious in the country's recent history. The Court of Appeal described the offending as carefully planned and as causing exceptional harm. That description was not for effect.

The breach itself

The attacker made off with records on around 33,000 Vastaamo patients in 2018, sat on the data for two years, then tried to extort the company. When that failed, more than 24,000 patients received personal demands for payment directly. When many refused, confidential therapy notes were dumped online.

The victims included children and people being treated for severe trauma. That is the part of the story that lingers, and the part the court leaned on when handing down the sentence.

A different category of harm

Most breach coverage focuses on the count. Millions of email addresses. Tens of millions of password hashes. The numbers scale, but the harm tends to be diffuse: a bit of spam, a forced password reset, a mild spike in phishing.

Vastaamo is a reminder that the worst breaches are not measured by volume but by content. A patient list is one kind of exposure. A patient's therapy notes, written in the assumption that no one else would ever read them, are another category of harm entirely. Once those files are on the open internet, no ruling from any court puts them back.

That is the awkward legacy of this case, regardless of whether Kivimäki is eventually arrested at a border crossing or spends the next decade quietly moving between jurisdictions. The sentence is on the books. The therapy notes are still out there. Only one of those problems is fixable.