The Helsinki Court of Appeal sentenced Aleksanteri Kivimäki to six years and 11 months in prison. The term stands one month short of the statutory maximum of seven years for the offences.
The court upheld the district court’s findings of guilt but raised the sentence from six years and three months imposed in April 2024 by the Western Uusimaa District Court.
Kivimäki denied all charges and sought dismissal of the case before the appeal court. Prosecutors called for a seven-year sentence.
The case concerns the breach of the psychotherapy centre Vastaamo’s patient database in November 2018. The perpetrator accessed the system without authorisation by using user credentials that did not belong to him. The court found that the intrusion required dedicated software and a detailed technical plan.
Judges stated that the offender reduced the risk of detection by using encrypted VPN connections. Servers involved in the offence relied on strong encryption methods.
In autumn 2020, the attacker attempted to extort money from Vastaamo. When that failed, patients began to receive blackmail messages. Sensitive therapy records later appeared on the Tor network.
The court convicted Kivimäki of aggravated data breach, aggravated attempted extortion, 20 counts of aggravated extortion, 9,231 counts of aggravated dissemination of information violating personal privacy and 20,745 counts of aggravated attempted extortion.
The Court of Appeal described the crimes as a planned entity that affected an exceptionally large number of victims in a vulnerable position. It stated that the acts were conducive to causing significant suffering.
“The offences were driven by the aim of obtaining significant financial benefit,” the court said in its judgment.
The judges assessed that a fair punishment would in principle have been the maximum seven-year term. They reduced the sentence by one month because Kivimäki reached conditional settlement agreements with numerous victims concerning compensation.
“The agreements are conditional, and according to the information presented no compensation has so far been paid by Kivimäki,” the court wrote. It added that the agreements justified only a minor mitigating effect, including possible savings in legal costs.
Kivimäki’s lawyer Peter Jaari said he had discussed the judgment with his client.
“Of course Kivimäki is deeply disappointed,” Jaari told Helsingin Sanomat. He described the ruling as the least expected of the alternatives considered by the defence.
Jaari said Kivimäki is currently abroad and that he does not know his exact location. The appeal court’s judgment is enforceable despite the possibility of applying for leave to appeal to the Supreme Court. Jaari said it is likely that his client will seek such leave.
Kivimäki must report to prison at a time set by the Criminal Sanctions Agency to serve the remainder of his sentence.
He has spent more than two and a half years in pre-trial detention. As a first-time offender under Finnish law, he becomes eligible for conditional release after serving half of the sentence.
French police arrested Kivimäki near Paris in February 2023 following an international search. The district court released him in February 2024 during proceedings, but the Court of Appeal later ordered him remanded in custody again. He evaded authorities for about a week before police found him in a flat in central Helsinki.
In September last year, during the appeal hearing, the court released him pending judgment, citing the length of his pre-trial detention.
The Vastaamo breach ranks as the largest criminal case in Finland measured by the number of victims. Separate proceedings linked to the case remain pending in the district court, including charges against another individual for aiding aggravated extortion.
HT