Court freezes assets as Vastaamo probe looks for answers

The private mental health provider at the centre of the data breach scandal was sold to a private equity firm in May 2019.

Vastaamo was owned by the Tapio family until the company was bought by private equity firm Intera Partners. Image: Juha Kemppainen / Yle

Helsinki District Court has ordered the temporary seizure of assets worth approximately 10 million euros from theformer CEO of Vastaamo, according to a report by commercial broadcaster MTV.

Ville Tapio's family have also had some of their assets frozen by the court.

The private mental health services firm has been at the centre of a hacking and blackmail scandal after it emerged that highly sensitive information on thousands of patients had been stolen from its database.

The Tapio family owned the company until it was bought by Helsinki-based private equity firm Intera Partners in May 2019, not long after a second breach of the psychotherapy provider’s data security systems.

Vastaamo’s board announced on Monday that an internal probe had revealed the second breach occurred in March 2019, and it appeared that the former CEO was aware of the breaches and of shortcomings in the firm’s data security systems at that time.

In a Facebook post on Monday however, Tapio did not mention the 2019 breach and wrote that he only became aware of the 2018 data leak after an external security review in October 2020.

Intera Partners had applied for the seizure of the Tapio family’s assets.

NBI: No breakthrough in case

Meanwhile, the National Bureau of Investigation (NBI) said on Tuesday afternoon that there had been no major breakthrough in the case.

Chief Inspector Tero Muurman told Yle that efforts are primarily focused on identifying and capturing the perpetrator, with the investigation into Vastamo's activities taking second place. The NBI is also unwilling to disclose too much information about the progress of the ongoing case.

On Friday, Parliament’s Administration Committee will discuss the case with a number of different bodies, including the NBI, the National Supervisory Authority for Welfare and Health (Valvira) and data security experts.