"Most Wanted" Hacker Released. Why Was He Let Out Early?
The state's financial burdens outweighed the suffering of thousands of victims.
The state's financial burdens outweighed the suffering of thousands of victims.
In a decision that has caused widespread controversy, the Helsinki Court of Appeal ruled on Thursday to release 28-year-old Aleksanteri Kivimäki, convicted of hacking the Vastaamo psychotherapy center and subsequent extortion, from custody pending a final verdict. He left the courthouse immediately after the hearing, without returning to the detention center where he had been held since February 2023. The court's decision does not imply a finding of innocence, but he will now continue the process as a free man.
The court noted that Kivimäki had spent almost two and a half years in custody, a duration comparable to part of the sentence he had already been given. A year earlier, a district court had sentenced him to six years and three months in prison for the severe cyberattack and extortion. According to Finnish law, a person with no recent convictions serves only half of their imposed sentence.
This means Kivimäki would soon have effectively served the portion of the sentence he would be required to serve if the verdict were upheld. If the Court of Appeal were to reduce the sentence, a situation could arise where the convicted person had spent more time behind bars than necessary, which would entail compensation from the state. This is why the court deemed further detention inappropriate.
Prosecutor Pasi Vainio opposed the release, but the panel of judges found the defense's arguments more convincing. Kivimäki's lawyer had insisted back in August on his release or at least a replacement of custody with a travel ban, arguing the risk of him serving an excessive amount of time in prison.
Kivimäki himself told journalists after the hearing that the court's decision did not surprise him. He described his time in custody as "annoying" and admitted he would have preferred to spend that time differently, though he did not consider his ordeal excessively difficult. He offered no words to the victims of the Vastaamo client data leak. Instead, he accused the police and prosecution of mistakes in the investigation.
The trial discussed numerous pieces of evidence. The investigation claims that a virtual server used for the attack contained materials linking it to Kivimäki, including a photo from a family summer cottage and publications about himself. He admitted uploading some files but denied any connection between the server and the crime. Furthermore, the extortion involved an IP address traced to an apartment in Barcelona. Kivimäki claims he was in London at the time and finds the idea that he could have used someone else's connection absurd. In his opinion, a resident of that apartment could be guilty.
The Vastaamo hack itself occurred in November 2018. A database containing confidential patient information was illegally copied. In the autumn of 2020, an extortion campaign began: the perpetrators demanded money, threatening to publish the data. As a result, personal records of thousands of clients were leaked publicly. The breach affected approximately 33,000 people, 24,000 of whom filed police reports.
After a multi-year investigation, Kivimäki was the one detained and brought to trial. In the first instance, he was found guilty and given a long prison sentence. The prosecution is now appealing for a harsher sentence of seven years—the maximum penalty for the charges. Kivimäki continues to maintain his innocence and calls the initial verdict mistaken.
Hearings in the Court of Appeal will continue until early November. Their conclusion is expected to bring a final decision, closing one of Finland's most high-profile criminal cases, linked to the largest medical data breach in the country's history.
