From teenage cyber-thugs to Europe’s most wanted

From teenage cyber-thugs to Europe’s most wanted

A notorious hacker who is one of Europe’s most wanted criminals has been jailed for blackmailing 33,000 therapy patients with their stolen session notes.

The imprisonment of Julius Kivimäki ends an 11-year cybercrime that began when he rose to prominence in a network of anarchist teenage hacker groups at the age of just 13.

Tiina was cooling off after a Finnish Saturday night sauna when her phone rang.

It was an email from an anonymous sender that somehow had his name, social security number and other personal details.

“At first I was stunned by the politeness and good tone,” he said.

“Dear Mrs. Parikka” wrote the sender, before underlining that they had obtained her personal information from a psychotherapy center where she was a patient. Almost apologetically, the emailer explained that they were contacting him directly because the company was ignoring the fact that personal data had been stolen.

Two years of meticulous records taken by her therapist during dozens of intimate sessions are now in the hands of this unknown blackmailer.

If he doesn’t pay the ransom within 24 hours, everything will be published online.

“It’s a suffocating feeling,” he said. “I sat there in my robe feeling like someone had invaded my private world and was trying to cash in on the trauma of my life.”

Tiina quickly realized she was not alone.

A total of 33,000 other therapy patients also had their records stolen and thousands were blackmailed in the largest number of victims in a criminal case in Finland.

The database stolen from the Vastaamo psychotherapist contains the deepest secrets of a large number of people including children. Sensitive conversations on subjects from extramarital affairs to criminal confessions are now a bargain.

Mikko Hyppönen, of the Finnish cyber security firm WithSecure, which investigated the attack, said the event caused shock waves in the country and led news bulletins for several days. “Hacking on this scale is a disaster for Finland – everyone knows someone affected,” he said.

This all happened in 2020 during a pandemic shutdown and the case shocked the cyber security world.

The effect of the email was immediate and devastating. Attorney Jenni Raiskio represents 2,600 victims and, at the hearing, said her firm had been contacted by people whose relatives had killed themselves after patient records were published online. He led a moment of silence in court for the victims.

The extortionist, known only as ransom_man through his online registration, demands that victims pay him €200 Euros (£171) within 24 hours or he will publish their information. If they don’t meet that deadline, he raises it to €500.

About 20 people paid before the victim realized it was too late. Their information was already published the day before when ransom_man accidentally leaked the entire database to a forum on the darknet.

Everything is still there today.

Mikko and his team spend time tracking down the hacks and trying to help the police, and theories begin to emerge that the hackers may be from Finland.

One of the largest police investigations in the country’s history involves a young Finnish man who is already famous in the world of cybercrime.

Zeekill Crime
Kivimäki, who called himself Zeekill as a teenage hacker, didn’t become a famous figure carefully.

As a teenager he was all about hacking, blackmailing and bragging at the top of his lungs. Along with the hacking teams Lizard Squad and Hack the Planet, he enjoyed causing chaos during the highly active teenage hacking period of the 2010s.

Kivimäki was a key player, carrying out dozens of high-profile attacks until, aged 17, he was arrested in 2014 and later found guilty of 50,700 hacking offences.

Controversially he was not imprisoned. The two-year suspended prison sentence has been criticized by many in the cyber security world. Even for Finland’s notoriously lenient sentences, the worry is that Kivimäki and his accomplices – mostly other teenagers scattered across the English-speaking world – will not be deterred.

Like many of his peers during this tumultuous time, Kivimäki did not seem to let the police raids stop him. After his arrest, and before his sentence, he carried out one of the most daring attacks of any teenage hacker group.

He and the Lizard Squad take on two of the biggest gaming platforms offline on Christmas Eve and Christmas Day. PlayStation Network on and Xbox Live went down after the service was hit with an unsophisticated but powerful technique known as a Distributed Denial of Service attack. Tens of millions of players are unable to download games, register new consoles or play with their friends online.

Kivimäki enjoyed world media attention and even received a TV interview with me for Sky News, where he showed no remorse for the attack.

Another hacker from Zeekill’s Lizard Squad told the BBC that Kivimaki was a vindictive teenager who liked to take revenge on rivals and show off his skills online.

“He is very good at what he does and doesn’t care about the consequences. He will always go further than others in attack.

“Despite the attention he got, he would make bomb threats and serious pranks calling himself undisguised,” Ryan said. He did not want to give his last name because he is still unknown to the authorities.

Apart from being linked to several smaller-scale hacks after his sentence, Kivimäki was not heard of for years until his name was linked to the Vastaamo psychotherapy attack.

Red Notice Issued
It took the Finnish police almost two years to gather evidence to issue an Interpol Red Notice for him and he became one of the most wanted criminals in Europe. But no one knows where the now 25-year-old is.

He was discovered by accident last February when police in Paris went to his apartment after receiving a false domestic disturbance call. They discovered that Kivimäki had been living with false identity documents under a false name.

He was quickly extradited to Finland where police began preparing for one of the most high-profile trials in the country’s history.

Det Ch Supt Marko Leponen led the three-year case and said it was the biggest of his career. “We had more than 200 officers on the case at one point and it was an intense investigation with so many statements and victim stories to go through.”

Kivimäki’s trial was a major story for the country with journalists there every day and international media present when he took the stand.

I was in court for the first day of his testimony and he maintained his innocence calmly and with occasional humor told the hushed courtroom.

But the evidence against him is overwhelming.

Det Leponen said linking Kivimäki’s bank account to the server used to download the stolen data was important.

Officials also used new forensic techniques to extract Kivimäki’s fingerprints from anonymous photos he posted online under a pseudonym.

“We can prove that the anonymous person posting on this forum is Kivimäki. It’s unbelievable but it shows that you have to use every measure you know and try what you don’t,” said Det Leponen.

Finally the judge delivered their verdict finding him guilty on all charges.

According to the court, Kivimäki was guilty of more than 30,000 crimes – one for each victim. He was charged with aggravated data breach, attempted aggravated blackmail, 9,231 dissemination of information injurious to private life, 20,745 attempted aggravated blackmail and 20 aggravated blackmail.

He was sentenced to six years and three months of the maximum seven years in prison, but he will likely serve only half that time because of time served and the Finnish justice system.

For victims like Tiina, this is not long enough.

“Many people are affected by this in many ways – 33,000 people is a lot of victims and it affects our health, and some have been targeted with financial fraud and using stolen data as well,” he said.

Meanwhile he and other victims are waiting to see if there will be any compensation from the case.

Kivimäki agreed in principle to settle out of court with one group of victims, but the others planned a civil case against either him or Vastaamo himself.

The psychotherapy company is now defunct and its founder has been given a suspended prison sentence for failing to protect patient data. Kivimäki did not tell police how much money he had in bitcoins and claimed to have forgotten his digital wallet details.

Ms. Raisko hoped the state government could step in but said it could take months if not years to examine each individual case to assess how much harm was done.

There are even calls to change the law to help deal with future mass hacking cases like this one.

“This is truly historic in Finland because our system was not prepared for this number of victims. The Vastaamo hack has shown us that we need to be prepared for this big case so I hope something changes. This will not end here,” he said.