The Helsinki District Court sentenced a 20-year-old man to a 16-month suspended prison sentence for a series of denial of service attacks which crippled online services at a number of banks and media organisations between 2013 and 2015.
At the time of the attacks, the defendant was under the age of 18. In addition to the suspended sentence, the man was ordered to perform 50 hours of community service.
The cyber attack immobilised financial transactions at banks such as OP on New Year’s Eve in 2014. It meant that customers were unable to withdraw cash or pay for purchases with bankcards and online banking services crashed. The attacks also targeted Nordea and Danske banks, the sentencing document said.
The Denial of Service attacks, which typically flood a service with traffic in a bid to overload and render them unrepsonsive, also targeted media organisations. According to the court, in autumn 2013, the man orchestrated service breaks and disruptions lasting nearly a week at commercial broadcaster MTV.
He was also convicted for launching similar cyber offensives against websites of the tabloid daily Iltalehti and the Finnish Communications Regulatory Authority (FICORA).
Large part of OP’s damages claim dismissed
The defendant was convicted of charges such as aggravated disruption of IT systems, six counts of disruption of IT systems and causing damage to data processing operations.
He was also convicted of attempted and aggravated extortion. The court said that when he engineered attacks against MTV and OP, he demanded the virtual currency Bitcoin in exchange for stopping the disruptions.
Although the defendant admitted to the cyber attacks, he denied all of the charges with the exception of one indictment on payment fraud.
The court ordered the man to pay OP bank 14,500 euros in damages. OP had previously called for more than 400,000 euros in damages but the court rejected the claim, saying that it was not proportional to the act.
Another young man under the age of 18 at the time of the events was also sentenced by the court. He received a three-month suspended sentence for disruption of IT systems, two counts of assisting with systems disruption and one count of attempted extortion. He denied all of the charges brought against him.