Criminal - What Happened When 33,000 People’s Therapy Notes Were Released Onto the Internet

Episode Date: August 25, 2026

Imagine receiving an email from a stranger that said your therapist’s notes about you would be released onto the internet for all to see —  unless you paid a ransom. That’s exactly what happened to 33,000 people in Finland in 2020, and it became the biggest criminal case in the country’s history. You can read Jenny Kleeman's reporting on this case here, and listen to her BBC podcast, called Ransom Man, here. You can also watch this interview at ⁠youtube.com/criminalpodcast⁠. Say hello on ⁠⁠⁠⁠Facebook⁠⁠⁠⁠, ⁠⁠⁠⁠Instagram⁠⁠⁠⁠ and ⁠⁠⁠⁠TikTok⁠⁠⁠⁠. Sign up for our ⁠⁠⁠⁠occasional newsletter⁠⁠⁠⁠. Follow the show and review us on ⁠⁠⁠⁠Apple Podcasts⁠⁠⁠⁠. ⁠⁠⁠⁠Sign up for Criminal Plus⁠⁠⁠⁠ to get behind-the-scenes bonus episodes of Criminal, ad-free listening of all of our shows, invitations to virtual events, special merch deals, and more. We also make ⁠⁠⁠⁠This is Love⁠⁠⁠⁠ and ⁠⁠⁠⁠Phoebe Reads a Mystery⁠⁠⁠⁠. Check out ⁠⁠⁠⁠our online shop⁠⁠⁠⁠. Learn more about your ad choices. Visit podcastchoices.com/adchoices

Support for Criminal comes from IM8. If you're looking for a way to make your supplement routine simpler, you might want to consider IM8. Their daily ultimate essentials has 16 supplements in one drink, and I like their lemon and orange flavor, which made the drink feel refreshing, especially in the morning. Go to IM8health.com slash criminal right now and use code criminal for a free welcome kit, five free travel sachets plus 10% off your order. That's code criminal at IM8 Health, dot com slash criminal. These statements have not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease. Avoiding your unfinished home projects

because you're not sure where to start, Thumbtack knows homes, so you don't have to. Don't know the difference between matte paint finish and satin, or what that clunking sound from your dryer is. With Thumbtack, you don't have to be a home pro.

You just have to hire one. You can hire Tatech. Operated pros, see price estimates, and read reviews all on the app. Download today. This episode contains mentions of suicide and sexual violence. Please use discretion. He was posting on Reddit and also the Finnish equivalent of 4chan. It's called Ululowlauta.

And he wrote, hello Finnish colleagues. We have hacked the psychotherapy clinic Vastomol.fI and taken tens of thousands of patient records, including extremely sensitive session notes and social security numbers. We requested a small payment of 40 bitcoins, nothing for a company with yearly revenues of close to 20 million euros, but the CEO has stopped responding to our emails. We are now starting to gradually release the patient records 100 entries every day. And he signed off the posts with a single word.

Enjoy. This is criminal. I'm Phoebe Judge. And before we start today's episode, I want to remind you that you can also watch this entire conversation on YouTube at YouTube.com slash criminal podcast. Today I'm talking with journalist Jenny Cleman about the biggest criminal case in Finland's history. Jenny covered the story for the BBC in her podcast, Ransom Man. Thanks, Jenny, for being here. Thank you so much for having me, Phoebe.

In October of 2020, people all over Finland, people all over. Finland started getting strange emails. What started happening? They received emails that contained details that nobody else should know. At first, they looked like spam, but when the people receiving the emails had a proper look at them, they realized that this was no ordinary junk mail. It had their name, their full contact details, and their social security number. And whoever had sent these emails knew that the person receiving them had been having psychosophobic them had been having psychotherapy through a service called Vastamo. The person who sent the emails said that they had accessed their therapy notes and if they didn't pay a ransom, those therapy notes would be released

online for the whole world to see. One of the women victims you spoke to, her name was Tina. Will you tell me a little bit about how she realized she was part of this? Tina received the email on a Saturday. She was a head teacher. It was right in the middle of COVID, and there had been a COVID burst at her school. So it was a really frantic time for her, and she was unwinding, like a lot of Finnish people do,

by taking a sauna. She got out of the sauna. She was just dressed in a towel, and she picked up her phone. She was idly looking through her phone, and there she saw the email. What role had therapy played in her life? What relationship did she have with therapy?

Therapy had been a lifeline for her. She was someone who was used to always being competent, always being in charge. She was a head teacher, she was a mother of three, and two of her children had been born extremely prematurely in the 1980s when the chances of having a premature baby survive are very low. those children had really serious disabilities. One of the children had cerebral palsy. The other one was blind. And for years, Tina had been juggling the care of her children, a demanding job, and a marriage that was in crisis. And she had been surviving. But then once she got a divorce and her children were independent adults with their own lives, she had expected she would be able to exhale, but instead she had a breakdown, and she found herself having very, very bleak, very dark

thoughts. I think she would probably say she wouldn't use the word, she didn't use the word suicidal when she was talking to me, but she did say to me there was a time when she was driving on the motorway at great speed, and she was thinking, I really wouldn't mind if this car crashed. So she was in a really serious situation when she sought therapy. So what did she do when she saw this email? She was terrified. She told me she thought she was going to have a heart attack and she didn't know what to do. She thought she was the only person to have received this email.

She was completely unaware that 33,000 people across Finland were having the same experience. The first thing she did was she called the police. That's what people do when they're in an emergency. And the police told her that she shouldn't be taking up the first. phone line, the phone line was for real emergencies. They couldn't help. So she felt utterly alone. And as you said, she was not the same person, the only person who had received that email that morning. No, she was not. She was far from alone. She was one of 33,000 people who had all received the same email from this hacker demanding money. And also, the demands were time pressured.

The hacker had said, you need to pay me the Bitcoin equivalent of 200 euros. Otherwise, the price will go up to 500 euros within 48 hours. So he wanted 200 euros within 24 hours. Otherwise, it would be 500 euros within 48 hours. And if he didn't receive payment by then, then the notes would be released for all to see. Were any of the notes being released? At the time that the ransom demands, were sent. The hacker had been drip feeding the notes of 100 people a day. He had cherry-picked

them and he had been putting them online in order to try and put pressure on Vastamo, the therapy service through which they'd all accessed therapy. And so every day, for three days, the hacker had been posting the most intimate, difficult, private thoughts. He had been deliberately choosing famous people, politicians, policemen, celebrities in Finland. And he'd also been trying to find the most extreme kinds of things in the therapy notes that could be leaked, details of child sexual abuse, affairs, secret homosexuality. And he had been dropping them every 24 hours for three days. And then on the third day, a much larger file was uploaded.

and it contained all the patient files. Everybody's therapy notes were just dumped on the dark web for all to see. What was he saying in his online posts as he put these therapy notes out there? He was posting on Reddit and also the Finnish equivalent of 4chan. It's called Ululowlauta. And he wrote, hello Finnish colleagues. We have hacked the psychotherapy clinic Vastomot.fI and taken tens of thousands of patient records, including extremely sensitive session notes and social security numbers. We requested a

small payment of 40 bitcoins, nothing for a company with yearly revenues of close to 20 million euros, but the CEO has stopped responding to our emails. We are now starting to gradually release the patient records 100 entries every day. And he signed off the posts with a single word, enjoy. Somebody alerted the hacker to the fact that he had accidentally dumped not only all of the patient

therapy files, but the contents of his home folder on his computer onto the dark web. And when he realized that this had happened, he went online, wrote the word, whoopsie, and then logged off forever. How did the victims react?

Many of the people who received the ransom email were not aware that their therapy notes had already been dumped on the dark web for all to see. No two victims reacted in the same way to learning that their therapy notes had been hacked. Some people were distraught and called the police.

Some people went online and tried to seek help in communities of other victims. Some people tried to contact Vastamo to get an answer from them. and we know that at least two people took their own lives after discovering that they had been hacked. We think that the worst breach you can imagine is we do everything we can to protect our social security numbers, right? Don't let anyone ever have your social security number. That is going to be the most personal, intimate thing until you think about someone reading the notes you say to your therapist.

I can't imagine a greater invasion of privilege. As Tina herself said to me when I interviewed her, we all have thoughts that we would never write down. We might not even write it down in a journal because we wouldn't want someone to read them. We might not even say those thoughts to our closest loved ones for fear of shocking them or upsetting them. But we would say them to a therapist if we thought we needed to for the sake of our mental health. That trust you have in your therapist is sacred. It's a vital part of the therapeutic process. And you, you know, Therapy doesn't work if you think you're speaking to the entire world when you're talking to your therapist. So it's hard to imagine a greater violation. And when I spoke to Tina, she said to me, it felt like a public rape to her. Did anyone initially know who did this or were they stumped? At first, nobody had any idea. It could be anyone. Some people thought that no Finnish person would ever do this.

They assumed it must be Russian hackers. But some people had different ideas about it because whoever was leaking these notes knew which notes to leak. They knew who was famous in Finland, who would get attention. And he also knew where to leak them in forums that are popular with Finnish people.

So it seemed to some people that this person was a Finn. How did Vastmo hear about the adept? the hack. I mean, how were they clued into this? Vastamo knew that their database had been hacked a month before any of their users knew. The hacker had originally tried to extort the company, had contacted the CEO and several other members of the company more than a month before all the files were released. And he was asking for a ransom in Bitcoin. The company called in a private security service to investigate whether or not the hackers' claims were credible. Medical data is an obvious target for hackers, and many hackers try and get into hospitals and

different kind of medical services. But there are also lots of hackers who don't have anything like what they claim to have when they're holding a company like this to ransom. So Vastom, the CEO employed this private security firm to see if there was any credibility in what the hacker was saying. And the security firm also demanded that the police be told at this earlier stage. So there was a kind of four or five week period where behind the scenes, Vastomer was frantically trying to stop the hacker from releasing this data, this incredibly precious data. But they were never going to pay a ransom that was never on the cards because they couldn't trust. They would have to trust in someone who was certainly a criminal that they would abide by their word and destroy the data once they'd received the ransom. And that's just not a viable proposition. It would leave them open to being victimized again.

So they were never going to pay a ransom. They tried to stall the hacker over several weeks to try and see if they could find out who this person was and stop him before it was too late. but in the end, the hacker lost patients and just leaked everything. How did the investigator find out about how they had been hacked? I spoke to one of the cybersecurity experts who was employed by Vastamo to look at what had happened. And this cybersecurity expert was actually a former detective in the Helsinki police, before going private. And he said he looked at Vastamo's servers and was really shocked by what he found.

The security on these servers had been incredibly lax in his view. He said he found that the database had effectively been left open. It was open to the internet with no firewall and essentially no password. The password was enter, so all you needed to do was press enter and you could get into the database. Were there initial clues, or what were the initial clues about who the hacker might be?

Initially, there weren't that many clues as to who the hacker was. People had some suspicions, but there weren't clues, and he was asking for payment in Bitcoin, which is theoretically impossible to trace, even if they had paid him. But once he dumped all of the patient files on the dark web and accidentally dumped also the contents of his home folder. That was a gold mine of clues for the authorities. Antikuritu, who's the cybersecurity expert, engaged by Vastamo that I interviewed,

said he started looking through the home folder, and he got this strange sense of deja vu whilst looking at it. He said that whoever the hacker was, they didn't organise their digital life. in neat files, like you would expect a professional hacker, someone who's used to making their living this way, would do. Things were organized in a kind of random dump of information. There was no organization. And there was also something strangely familiar about the way the hacker was naming the files. It wasn't done in a way that somebody who is trying to be logical and help their future self out by giving the files a name that anyone could find at a later date.

He was giving sort of jokey names for the files. For example, the file containing the patient's notes was called Therapist, P-I-S-S-E-D. And there was something about this kind of juvenile approach to hacking and naming files that brought Auntie Kuritu back to his time in the Finnish police, and he remembered getting hold of a hard drive belonging to a 16-year-old boy who had organized his digital life in very much the same way. And that boy was Alexander Julius Kivimaki. Who was Kivimaki? Kivimaki is probably one of the most famous hackers in Finland, not because he's a particularly sophisticated hacker, but because of the lengths that he was prepared to go to cause harm

and drama wherever he went. When he was younger, when he was 14 years old, he first came to the attention of the authorities. He'd been involved in a group called Hack the Planet that has hacked into MIT and taken over their homepage and their domain. But he quickly progressed to even bigger targets and more audacious, outrageous hacks. He once rang in a fake bomb threat on a plane carrying the executive in charge of PlayStation for Sony. and that grounded the entire plane. On Christmas Day one year, he and a group of people that he was working with

are said to have hacked into Xbox and PlayStation, meaning that Christmas was ruined for millions of people across the world because they couldn't get online and play their new games. And he seemed to really enjoy the drama of it when Lizard Squad, who's the hacking group that he was involved with, were linked to this Sony and PlayStation Christmas Day hack. He went on television giving interviews, not using his real name, but with his face completely undisguised,

saying that he'd done it because, you know, he thought it was depressing that kids were not going to be speaking to their families over Christmas, and he was doing it because he could, because it was fun, and because he found it funny. You spoke with another hacker he used to chat with on forums, Blair Strader. Yes. Blair and Julius initially were friends, I guess you could say, or at least Blair found him amusing at first. They used to chat together on internet relay channels connected to hacking. And then they had a falling out when Julius was 14 and Blair was 17.

It was over a small thing. Who was going to host the report of a recent hack? on their own server. They had this fight, and then pizzas started turning up at the home Blair shared with his family in Illinois. And when the family would open the door, the pizza delivery guy would say, oh, it's a pizza for Julius Kivu Mackie. And then Chinese food was ordered, taxis were ordered,

sex workers would turn up at the house, three tons of gravel was delivered to their home. then somebody hacked into the Twitter account of Elon Musk and Tesla giving Blair's address and saying that if anyone wanted a free car, all they needed to do was turn up at Blair's home. And also his phone number, their home phone was not usable for an entire weekend. Then someone hacked into Blair's mother's Twitter account and posted racist and anti-Semitic slurs directed at her employer, Blair's mother lost her job shortly after that. Someone had been calling the police claiming to be Blair Straitor

and claiming that he had murdered his mother. And the police turned up several times with laser sights fully armed to the teeth outside the Straiters home. This happened several times. And then eventually somebody phoned in a bomb threat on the local police force claiming to be Blair. And Blair got taken away and put in juvenile detention for three weeks over Christmas. So Blair's life was effectively ruined because of the feud that he had been having with Julius Kivoumaki.

So when you spoke with Blair, he had no doubt that Kivimaki could be, had it in him to do something like release the therapy notes of all of Finland. Yes, Blair said to me that he wasn't the person. He knows people who were victimized more than he was by Kivimaki, other people. online. And Blair was furious that nothing could have been done to stop him beforehand. He had called the police. He had reported Kivu Maki to the authorities, but

still Kivi Maki had never faced the consequences for anything he allegedly did to Blair. And so it didn't surprise him that Kivu Maki's name was being brought up in connection with this huge crime in Finland. We'll be right back.

To listen without ads, join Criminal Plus at patreon.com slash criminal. Support for criminal comes from Skylight. Family life can be busy. Between school, work, activities, and appointments,

it's easy for plans to get lost in the shuffle. Skylight gives everyone one central place to see what's coming up, helping the whole family stay organized. The all-in-one digital smart calendar syncs with Google Calendar, Apple Calendar, Outlook, and more. You can organize chores and grocery lists

and color code everything by a family member. So instead of constantly reminding everyone what's happening next, each person can easily see where they need to be and what they need to do. One of our producers has tried Skylight. She says the color code feature is a really helpful tool and makes it easy for kids to check the calendar on their own. Families are better when they're working together. Right now, Skylight is offering our listeners $30 off their 15-inch calendars

by going to MySkylight.com slash criminal. Go to my skylight.com slash criminal for $30 off your 15-inch calendar. That's M-Y-S-K-Y-L-G-H-T dot com slash criminal. Support for this show comes from O-Doo. Running a business is hard enough, so why make it harder with a dozen different apps that don't talk to each other? Introducing O-Doo. It's the only business software you'll ever need. It's an all-in-one fully integrated platform that makes your work easier.

CRM, accounting, inventory, e-commerce, and more. And the best part, O-DU replaces multiple expensive platforms for a fraction of the cost. That's why over thousands of businesses have made the switch. So why not you? Try O-D-O-4-free at O-D-O-O-D-O-com. What did police start investigating this therapy hack? The home folder that the hacker had left was incredibly important to the investigation.

And they were trying to establish that they were looking for links between Julius Kivimaki and the hacker who had been calling himself ransom man in online forums in his online posts. There were several links between Kivimaki and Ransom Man. The first was that a credit card

that Kivimaki had been using to pay for an Apple subscription and an only fan subscription had also been used to pay for servers that were involved in the hack. So a credit card linked to Kivoumaki was also linked to Ransom Man. During the initial negotiations, Ransom Negotiations with Vastamo,

Vastamo had made a payment of 0.1 Bitcoin to Ransom Man. And the intention was that this would be some kind of breadcrum, something to follow. and the police, using quite sophisticated techniques, had managed to see that when that Bitcoin was turned into real world currency, laundered into real world currency, it had ended up in Julius Kivi Mackie's account. But for me, the thing that was most striking, the piece of evidence that was most striking, was that when they looked at the home folder that the hacker had accidentally leaked, they were able to look at the hacker's command history, which means

they were able to look at exactly what the hacker had been doing on his computer at what time in what order. And they found that as well as searching for paedophilia, rape, adultery, the most outrageous things in the therapy notes to flaunt online. The hacker had also been looking for details that would only be relevant to Julius Kivimaki. Julius Kivoumi Maki's loved ones, places where Julius Kivimaki lived, essentially, the hacker was trying to make sure that there wasn't anything in the patient notes that would have a negative effect on Julius Kivoumaki or his loved ones

before those notes were leaked. And also in the home folder there was a photograph which they managed to establish had been taken at Julius Kivimaki's grandparents' cabin. There was a final piece of circumstantial evidence that was extremely

important. When the notes were all leaked, they were leaked from an IP address in London. And they could tell from records that the person living at that particular address at the time in London, the person renting that apartment was Julius Kivie Mackie. So they had pretty good evidence of who had done this. But what were some of the challenges they were facing in the investigation? There were many challenges. First of all, there were terabytes and terabytes of data to sift through. They also had an enormous number of victims. Each

one of them had to register an individual complaints. So even though the therapy notes of 33,000 people were leaked, I think there were only around 21,000 people who registered themselves as victims on this online portal that they set up. But they had to go

through everybody's individual complaint, check that they actually were victims, they had gone to therapy with Vastamo. And also, there were other challenges in that whilst there was a huge web of evidence linking Julius Kivoumaki to Ransom Man, there was no smoking gun.

It was all circumstantial evidence, building up a picture of someone who, it was incredibly likely, was responsible for the hack. But they didn't catch him in the act sitting behind his computer. There was no one single definitive piece of evidence that on its own would prove that Julius Kivimaki was Ransom Man. And as this whole investigation was going on, I mean, the therapy notes had been released were out there. Were people reading these notes?

I think Finnish people were very good at not making public anything that had been illegally stolen and leaked online. But that's not to say that people didn't read this stuff. When it was first leaked online, even some of Finland's hackers were appalled. and expressed their disgust, said, you know, this is beyond the pale, this is too much. But lots of people did look, and people were commenting on the forums and laughing about people's therapy notes.

I spoke to someone who said she remembered a victim who had gone online to see if her notes were there. And she said, when she looked at the forum, she could see people laughing about a 10-year-old child who had gone to therapy, because they were children among the victims as well. And we know that even though the therapy notes were taken down from lots of platforms,

an untold number of people had taken a copy. And in the months and years following the leak, those therapy notes continue to circulate online. People have even made searchable databases, so all you need to do is put in someone's name, and you can call up their therapy notes. So this shows that this isn't just about a single hacker who was prepared to break every moral boundary possible.

It is a thing that other people are prepared, do too. So once the notes are released, it's not as though Vostimo or the Finnish government could pull them back. They were out there. Once things are online, they are online forever. And we don't know how many people took a copy of those notes and still have those notes sitting in a hard drive prepared to use them. Several of the people I interviewed have had people try and get out credit cards and loans in their name and all the other things that can happen when your social security number is out there. The Finnish authorities are not allowing them to change their social security numbers. So this is something they're going to be living with for the rest of their life, not just the

therapy notes being leaked, but their identity effectively being stolen too. You spoke with a lot of victims of this hack. What were some stories that stuck out to of people's experience with it? I spoke to a very successful comedian in Finland, who's a stand-up comic. And, you know, for him, he had had suicidal, thoughts, and yet he's a professional funny man. He needs the audience to be laughing along with him. So it was terrifying a first for him. But then he very quickly realized that, no, he was going to use this personal experience as part of his act, and he was going to make jokes about it. And he said when he got up on stage and started talking about it, the first people were awkward

and are nervous to hear him talk about what had happened. But as he looked out into the audience, he saw many nods of recognition, and he realized there were other Vastamo victims in the audience, too. And this is a country of just over 5 million people. 33,000 people had their therapy notes hacked, so everyone knows someone who was a victim. And he realized that by facing his worst fears head on, by realizing that people were going to know his vulnerabilities, his worst fears actually weren't so bad, and he felt emboldened. by the fact that he was able to talk about this publicly and be okay. Do you know, I think that if, not even if my notes had been released,

but if my partners or my mothers or my, I would not want to read them because I wouldn't want to be hurt my, you know, so it's the peoples whose notes are released, but it's also, oh no, what if they were talking about me? I mean, can you imagine the strife in homes over the dinner table? Absolutely. And, you know, some people hadn't even told their family members they were going to therapy. There's also this kind of extra layer, which I hadn't really thought about until one of the victims told me that it was a big source of anxiety for her, which is, you know what you told your therapist, but you don't know what your therapist wrote down. You don't know how they interpreted what you said. One of the people who I interviewed said, she was desperate to know what her therapist had said. And in fact, she went to Vastomog. She asked for Vastomachian. Bastamu to give her a hard copy of her notes. She was the one who had been on the dark web looking for her notes.

And she said when she read what her therapist had written, she was really hurt by how she had appeared to him. The therapist had said things like, you know, that she was talking in an erratic manner, that she had an immature way about her, various things like that. And she felt devastated that she had appeared that way to her therapist. and she also was taken back to the time of crisis that she had been in when she went to therapy. A lot of people had made huge gains going to therapy,

which were just completely undone by the fact that these therapy notes were out there. And a lot of people had completely lost faith in the therapeutic process and in doctors. You know, people felt that they couldn't trust their doctors anymore and they didn't feel comfortable going to doctors anymore. because if this incredibly sacred space could be breached, how could they trust anywhere else to be safe? Tell me about the arrest. Two years after the first ransom emails were sent,

the Finnish police announced that they had a suspect, Julius Kivimaki, but they couldn't find him. He's a very international person. They didn't know exactly where he was. He was put on Europol's list of most wanted fugitives. Then in February 23, the police in Paris got a tip-off about a domestic disturbance. They visited an address at 7 a.m. in a Paris suburb, somebody had rung and said that they had heard shouting and they were worried that a woman was being victimized by her partner. The police knocked on the door, got no answer. They knocked the door down with a battering ram.

And inside they saw a kind of bleary-eyed couple, no sign of any disturbance. They asked the man to hand over his passport to identify himself. And the man who was over six-foot tall, blonde-haired, blue-eyed, handed over a passport identifying himself as a Romanian national called Assan Ahmed. The police thought that the name didn't match the face. They put the name through their databases and found out that, Assan Ahmed was a known alias for Julius Kivimaki. So he was finally arrested and then sent back to Finland to face justice.

What were the charges? Kivimaki was charged with 9,600 counts of aggravated invasion of privacy and more than 21,000 counts of attempted aggravated extortion. How did the victims find out that someone had been arrested? Most of them saw it on the news. And for some of the people who saw it on the news, it was really traumatic, particularly because Julius Kivoumaki looks like any other regular finish guy. And seeing him walking into the courthouse, I know certainly for Tina, it was extremely traumatising. She was sitting down to watch the news with her partner.

And up came Kivu Maki into her living room. and she felt completely distraught. She said she couldn't sleep for nights after then because it felt like another violation. Other people I spoke to were just shocked by his ordinariness. I think perhaps it would be easier to imagine that this was kind of Russian criminals or criminals from overseas,

you know, intent on doing you harm. The idea that it would be a fellow Finn, the sort of person who would pass in the street every day, who was responsible. That was really traumatizing for some people. What was the trial like? The trial was a bit of a circus. Julius Kivimaki seemed to enjoy his time in the spotlight.

He would come in reading different books. He came in reading a book by Elron Hubbard about Scientology one day. The next day he came in reading War and Peace and he liked to prop up his books in front of the cameras. There was no jury. There were three judges. And Julius Kiviewakki was playing computer games on his court-approved computer throughout most of the trial, I was told. He seemed bored unless they were talking about specific pieces of hacking evidence,

in which case he would become more engaged. And is it true that there were so many victims who wanted to, watch what was going on that they were they were broadcasting in movie theaters there were 21,000 over 21,000 registered victims in this case and no courtroom in the world is big enough to house 21,000 victims so the Finnish authorities set on set up public screenings in places like movie theaters across the country some of the people I spoke to attended some of these screenings and they said it was just profoundly awkward experience because you're there because your privacy has been violated,

and yet you are sitting next to other people whose privacy has been violated, and you don't really know what to say to the other people there. So everyone pretty much tried to keep to themselves in this very surreal environment. And he was convicted? He was. He was eventually found guilty.

After a trial during which he had at one point escaped and apparently gone on the run and couldn't be found for a week. It was a trial first. of drama, but eventually he was caught and he was brought to face justice and he was convicted of all of those charges, guilty on all charges, and sentenced to six years and three months in prison, which is actually a long time by Finnish standards, but a few months shy of the maximum sentence he could have received. And in fact, recently Julius Kiviyamaki tried to appeal

this sentence. He lost his appeal. his sentence was increased by another six months. I've got to tell you, it doesn't seem long enough. It really doesn't. The whole thing I found reporting this story is that the suffering is kind of unquantifiable. When you have 33,000 people whose lives have been turned upside down by this crime, it's an impossible thing to measure. And in fact, the prosecutor who I interviewed said,

he and his colleagues had tried to quantify how much suffering this had caused, multiplying the number of victims by a week. Like if you could assume that each victim suffered a week of suffering, how much suffering was caused by this crime? And he said, when you do the maths, if you allow each victim of week of suffering, this crime caused 635 years of suffering. Was there any compensation for the victim?

The victims are going to get compensation ranging from a few hundred euros to a few thousand, depending on what was in their therapy notes, how many pages of notes were in Vastomor's database, and how sensitive the details in those notes was. The Finnish authorities are probably going to end up paying that compensation. It's not going to come from Julius Kivimaki because he claims to have no money and none of the police have been able to find any of his money. money if he does have money.

You actually met him. What was he like? At first he didn't want to meet me. And in fact, I was in Finland reporting this story with him continually saying no. And then on my last day of reporting, when I had a few key interviews left to record, I heard that he changed his mind. And so I dumped all my other plans and got on a train to Turku, which is where he was in prison. It was one of the most extraordinary interviews I've ever done in my life. I was told I would

only have about 15 minutes with him. I had over two hours with him. He turned up 40 minutes late and at first I thought he was just trolling me that he just wanted to kind of ruin the plans that I had for doing interviews that day without any intention of ever leaving his cell, but he did eventually arrive. And for two hours, he looked to me straight in the eye and unemotionally answered all of my questions. He maintained his story, which was that he didn't do it. The police have all of this evidence, but it's just circumstantial. I said to him, you'd have to be the unluckiest person in the world to have so many pieces of evidence linking to you. And he said, well, the correct answer is that it's not me, but it's somebody close to me.

I said, oh, so who is it then? And he said, I have a good idea about who it is, but I'm not going to tell you. I don't want to name any names. And Julius Kivu Macki had always made a very big deal out of living a very luxurious lifestyle. He was always posting on social media about drinking champagne in Santa Rosa, going on luxury holidays. And to me, the idea of that person being willing to serve time in a finished prison for somebody else seemed quite absurd. I asked him if he had anything to say to the victims. I told him that Tina had said to me

that having her notes leaked felt like a public rape. And he said, well, I'm sure she feels that way. I don't have anything to say to the victims because I didn't do it. And I said, well, you know, you must have some response to this crime on an emotional level. Whenever I talk to anybody about this story that I'm doing, they have an emotional response to it because it's so outrageous. And he said, well, no, it's just another story in the news. What's in the news at the moment?

Oh, you know, people being killed in Gaza. It's like that, he said. How do most people feel when they see news about Gaza? The answer is most people, they feel nothing at all because they've got nothing to do with those victims. So that's how I feel. They're nameless, faceless people. That's what he said to me. Did it make you, I mean, if the courts are right and he is guilty?

and he was lying to you. Does it make you think that when he is let out in just a few years, one should be worried about what he might do next? I think we should all worry about what he might do next because he is a criminal without boundaries. As far as I can tell at the moment, he is not in custody. He's supposed to be back in prison,

but the Finnish authorities haven't been able to find him, because he was released during the appeal. He was released from prison, and they haven't been able to locate him yet. On a personal level, I don't feel that I am going to be a particular target for him. I think he always has his sights set on bigger, more dramatic high-profile targets than the likes of me.

But I could be wrong. I've tried to take care with my digital life, But I'm also somebody who hasn't put a lot of myself online, which is perhaps what draws me to this story is I've always been afraid of what can happen when you live too much of your life in a digital way. I mean, I'm sitting here in my office now and looking up at the 500 or so notebooks that I still keep with all of my work. I'm still someone who still very much believes in paper and pen.

But, you know, this sort of thing can happen to any of us. So much of our lives is now spent online. you know, I still communicate with my doctor online. So much of my work is conducted online. You know, it's an undeniable fact of our lives now, and we know that whatever we put into a computer or into a phone could one day get into the hands of somebody that we don't want to have it. But that doesn't stop us from doing it, because this is just part of human life now. Well, Jenny, thank you very much for speaking.

Thanks so much for having me, Phoebe. That's journalist Jenny Clemen. You can find the link to her podcast series for the BBC called Ransom Man at the link in our show notes. In addition to listening here, you can also watch all of these Tuesday conversations on YouTube. Just go to YouTube.com slash criminal podcast or click the link in our show notes. I'm Phoebe Judge. Thanks for listening. Are you a pet owner? Every six seconds, a pet owner in the U.S. gets.

hit with a vet bill over $1,000. Always an unwelcome surprise. That's where Fetch comes in. Fetch is the most complete pet insurance for dogs and cats, according to consumer advocate.org. You get paid back up to 90% of vet bills at any vet in the U.S. in Canada, with claims paid back in as a little as two days. Go to fetchpet.com slash save right now for your free quote.

That's fetchpet.com slash save.