Auer has struggled with depression for most of her life

Meri-Tuuli Auer knew instantly that the email sitting in her junk folder was not ordinary spam.

The subject line contained her full name and her Finnish social security number — the unique identifier used to access banking and public services. Inside were details about her life that no stranger should have known.

The sender claimed they had hacked the patient database of Vastaamo, a Finnish psychotherapy provider where Auer had received treatment. They demanded €200 (£175) in bitcoin within 24 hours — or €500 within 48. If she refused, they warned, her personal data would be published online: her name, address, phone number, social security number, and detailed therapy notes containing transcripts of her sessions.

“That’s when the fear set in,” Auer, now 30, says. “I took sick leave from work. I shut myself inside my home. I didn’t want to go out. I didn’t want anyone to see me.”

In October 2020, Auer became one of 33,000 Vastaamo patients targeted by a nameless, faceless hacker who had stolen one of the most sensitive datasets imaginable: psychotherapy records.

Patients’ private confessions — including details of suicide attempts, infidelity, addiction, and child sexual abuse — were suddenly weaponised.

In a country of just 5.6 million people, almost everyone seemed to know someone affected. The breach became Finland’s largest-ever criminal case. Then–Prime Minister Sanna Marin convened an emergency meeting of ministers.

But the damage was already done.

Before emailing patients, the hacker had published the entire database on the dark web. Unknown numbers of people had already accessed or downloaded it. The records have circulated ever since.

Auer had shared things with her therapist that she had never told her closest family members — about binge drinking and a secret relationship with a much older man. Now, her worst fear had come true. Yet instead of breaking her, the breach forced her to confront something unexpected: her own resilience.

A Life Behind the Records

Auer’s flat on the outskirts of Helsinki feels joyful. Barbie memorabilia lines the shelves, and a pole-dancing pole stands in the centre of her living room. But appearances are deceptive, she says. She has struggled with depression and anxiety for most of her life.

“I’m outgoing and confident, and I love being around people,” she says. “But I always feel like they think I’m stupid or ugly — like my whole life is just a series of mistakes.”

She first sought therapy in 2015. With her Vastaamo therapist, she spoke openly about her mental health, her drinking, and the secret relationship she had at 18. She trusted him completely. She never imagined what his notes might look like.

Driven by fear, Auer searched the dark web herself.

“I had never used it before,” she says. “But I thought, I just have to see if my records are there.”

At first, they weren’t. She closed the file without reading anyone else’s notes. But she saw other users mocking patients’ pain.

“A 10-year-old child had gone to therapy, and people were laughing about it.”

When it became clear that all patient records had been published, Auer’s mental health rapidly deteriorated. She became afraid to leave home, to take public transport, even to open the door to the postman. Like many victims, she doubted the hacker would ever be caught.

The Investigation

Kivimäki was sentenced to more than six years in prison for the hacking of Vastaamo

Finnish police feared the same.

“This wasn’t a normal case,” says detective Marko Lepponen, who led the investigation. “The scale was unimaginable.”

After two years, investigators named a suspect: Julius Kivimäki, a well-known Finnish cybercriminal.

“That’s when the fear set in,” Auer, now 30, says. “I took sick leave from work. I shut myself inside my home. I didn’t want to go out. I didn’t want anyone to see me.”

In February 2023, Kivimäki was arrested in France and extradited to Finland. More than 21,000 former Vastaamo patients registered as plaintiffs — so many that courtrooms were too small to accommodate them. Public screenings of the trial were held in cinemas.

Auer attended one.

“He looked like a completely ordinary Finnish young man,” she says. “It made me feel like it could have been anyone.”

Kivimäki was convicted and sentenced to six years and seven months in prison. He continues to deny responsibility.

“No sentence could ever make up for what happened,” Auer says. “But the court recognised the victims’ suffering. That mattered.”

Living With the Leak

Years later, the consequences continue. Someone has built a search engine that allows people to locate therapy records on the dark web by typing in a name. Auer requested a hard copy of her own records. They sit in a thick stack on the table as she reads aloud.

“The patient is mostly angry, impulsive, bitter,” one note reads. “There is some interpersonal difficulty stemming from the patient’s weak-tempered nature.”

Reading them for the first time broke her heart.

“I was hurt by how I was described,” she says. “It made me feel sorry for the person I used to be.”

The breach, she says, has destroyed trust in therapy. Many former Vastaamo patients, she believes, will never seek professional help again.

The lawyer representing victims in a civil case has confirmed at least two people died by suicide after learning their therapy notes had been stolen.

Taking Back Control

Auer was one of 21,000 former Vastaamo patients who registered as plaintiffs in the case

Auer chose not to hide.

She posted openly on social media about being a victim. She told her family everything — including the secret relationship she had never spoken about before.

“Once everyone knew, it became easier,” she says. “People were kind. They were supportive.”

Finally, she reclaimed her story by writing a book about the experience. Its title roughly translates to Everyone Gets to Know.

“I turned it into a narrative,” she says. “At least I can tell my side — not just the version written in patient records.”

Finally, she reclaimed her story by writing a book about the experience. Its title roughly translates to Everyone Gets to Know.

She knows her secrets will never truly disappear.

“For my own wellbeing,” she says, “it’s better not to think about it.”