Finnish authorities are looking for convicted hacker Aleksanteri Kivimäki after the country’s Supreme Court declined to take up his appeal in the Vastaamo psychotherapy breach case, according to Finnish media reports.
The decision leaves intact a February ruling by the Court of Appeal that sentenced Kivimäki to nearly seven years in prison for breaking into psychotherapy provider Vastaamo and later extorting the company and its patients. The case is one of Finland’s most consequential cybercrime prosecutions, both for the sensitivity of the stolen records and for the number of victims.
Eastern Uusimaa Police said they issued a wanted notice at the request of Finland’s Criminal Sanctions Agency, Finnish media reported. Police have been told to arrest Kivimäki if they find him and take him to Vantaa Prison, where he is expected to serve the remaining part of his sentence.
Kivimäki’s lawyer, Peter Jaari, told Finnish outlet Yle that he does not know where his client is. Jaari said he believes Kivimäki is outside Finland.
The conviction is now final
The Court of Appeal convicted Kivimäki of aggravated data breach, attempted extortion and unlawful distribution of private information. According to Finnish media, the court found that the crimes were planned carefully, motivated by money and caused exceptional damage to a large group of particularly vulnerable people.
The judges said the offenses would ordinarily have supported the maximum sentence available. They reduced the prison term by one month because Kivimäki had reached compensation agreements with some victims.
Kivimäki has denied responsibility throughout the proceedings. He argued that prosecutors leaned heavily on circumstantial evidence, contested the digital evidence tying him to the intrusion and disputed claims about cryptocurrency transactions connected to the extortion campaign.
He had been free while the appeal process continued. The appeals court released him from pretrial detention in September 2025 after concluding that he had already spent enough time in custody and that keeping him detained longer could breach his rights. Because much of the sentence had effectively been served before the final appeal stage, Kivimäki remained out of prison until the Supreme Court’s decision.
With the Supreme Court declining to hear the case, Finnish authorities now treat the conviction as final and are trying to bring him back into custody.
A breach built for maximum harm
The Vastaamo intrusion happened in 2018, but the public did not learn of it until 2020. The attacker first tried to extort the company. After that, demands went directly to thousands of patients.
When many people did not pay, confidential therapy notes and other sensitive records were posted online. The stolen database held information on about 33,000 patients, according to Finnish media. More than 24,000 people reported receiving extortion demands.
The mechanics were ugly because the data was ugly to expose: psychotherapy records, personal histories and treatment notes, tied to identifiable patients. Finnish media has described the case as the largest criminal case in Finland’s history by victim count. Many victims were children or people receiving care for severe psychological trauma.
That is why the wanted notice is more than a procedural afterword. The Supreme Court’s refusal to hear the appeal closes the legal path that had kept Kivimäki free, and it puts the remaining task back in the hands of police and prison authorities: find him, arrest him and return him to serve what is left of the sentence.
This story draws on original reporting from The Record.
