Cyber Attack Exposes Therapy Secrets: A Patient's Trauma and Triumph

Sat Jan 17 2026 15:14:30 GMT+0200 (Eastern European Standard Time)

Meri-Tuuli Auer, a victim of the Vastaamo hacking scandal, shares her harrowing experience of having her sensitive therapy notes leaked online and her journey to reclaim her narrative.

In 2020, Meri-Tuuli Auer became one of the 33,000 patients affected by a massive data breach involving Vastaamo, a Finnish psychotherapy company. After the hacker demanded a ransom to prevent the release of sensitive information, Auer faced the terrifying reality of having her deepest struggles exposed. The incident triggered a national response and led to a prolonged investigation, culminating in the arrest of the hacker. Auer's story highlights the lasting impact of privacy breaches on mental health and the resilience required to overcome such violations.

A soon as Meri-Tuuli Auer saw the subject line in her junk folder, she knew it was no ordinary spam email. It contained her full name and her social security number - a unique identifier used in Finland for accessing public services and banking.

The email was filled with details about Auer that no one else should know. The sender threatened to publish her personal information, including detailed patient records from her therapy with Vastaamo, unless she paid €200 in Bitcoin, escalating to €500 if she delayed.

That's when the fear set in, Auer recalls. I took sick leave from work and isolated myself at home. She was one of the 33,000 affected by the hack on Vastaamo, which released sensitive psychological records publicly. The breach unsettled Finland, leading to an emergency meeting convened by then-Prime Minister Sanna Marin.

Auer had shared intimate thoughts with her therapist, including issues of self-harm and abuse, making the leak a national scandal. The hacker not only demanded ransom but had already published records on the dark web, allowing the information to circulate uncontrollably. Auer found herself paralyzed by fear, concerned about who might read her private struggles.

As a consequence of the breach, many patients, including Auer, were left vulnerable. I was terrified to leave the house, she admitted. The psychological toll of the incident compounded her previous battles with anxiety and depression.

After a lengthy investigation, authorities apprehended cybercriminal Julius Kivimäki, who was convicted and sentenced to six years in prison in early 2023 for orchestrating the attack. However, Auer stressed that no sentence could undo the harm caused.

Months later, Auer requested printed copies of her therapy records, which served as a painful reminder of her vulnerabilities. Despite her hurt and anger, she resolved to confront her ordeal head-on. Sharing her experience online helped her reclaim her narrative, leading her to publish a book titled 'Everyone Gets to Know,' where she details her journey and the impact of the breach on her life.

Auer emphasizes the continuing stigma and fear resulting from the breach, stating that many former patients may never seek therapy again due to mistrust. The psychological ramifications continue to haunt many, with reports of at least two suicides linked to the scandal. Yet, Auer finds solace in her resilience, stating, It’s just better not to think about it for my own wellbeing.