Breach Disclosure: Vastaamo

In late 2018, Finland-based psychotherapy service, Vastaamo, suffered a data breach that resulted in the exposure of 30,000 patient records. These records included patient names, social security numbers, and patient notes from therapy sessions. The compromise became public in 2020 after victims received extortion messages from attackers threatening to publish their private information unless they paid a ransom demand of EUR 200 (approximately USD 240 during the time).

Standing Intelligence Requirements

PII & Fraud

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.
Review network logs for potential signs of compromise and data egress.
Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

In May 2021, an actor using the alias "Zan" published a thread on a cybercriminal marketplace network advertising the sale of the Vastaamo data breach. Approximately 30,000 records were in the breach package. The post also contains a list of database headers for infomration obtained from the breach. It is unclear if this actor initially breached the company or purchased the database from another seller in order to leak publicly for the first time, as the breach information circulated on other cybercriminal marketplaces.

Figure 1: Actor "Zan" publishes a thread on Vastaamo data breach package