Vastaamo data breach: 30K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2021-07-17
In October 2020, the Finnish psychotherapy service Vastaamo was the subject of a ransomware attack targeting first the company itself, followed by their patients directly. The original security incident dates back to a period between late 2018 and early 2019 and exposed data including 30k unique email addresses, names, social security numbers and notes on individuals' psychotherapy sessions. This breach has been flagged as "sensitive" and is only searchable by owners of the email addresses and domains exposed in the incident. Exposed data: email addresses, names, personal health data, social security numbers. The breach dates from Mar 31, 2019; Have I Been Pwned loaded it on Jul 17, 2021.
What to do
- If you had a Vastaamo account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch
