Thread by @WIRED

It's often referred to as the “McDonald’s of psychotherapy.” Vastaamo is the largest network of private mental health providers in Finland, a country with a population of about 5.5 million. 1/ wired.trib.al/vv5Fagr

A security flaw in Vastaamo’s IT systems exposed its entire patient database to the open internet—not just email addresses and social security numbers, but the actual patient notes written by their therapists.
Artist palette: Mark Harris
2/

30,000 former patients are believed to have received ransom demands from the hackers who breached the class B system; leading 25,000 of them to report the attempted extortion to the police. 3/

Ex CEO, Ville Tapio aimed to grow Vastaamo into a network of brick-and-mortar clinics by digitizing everything but the appointment itself—allowing independent therapists to spend more time with clients.
Artist palette: Mark Harris
4/

Rather than use an existing system to create an electronic medical record system, the company designed its own. While the software quickened therapists' work, the slick exterior concealed some deep vulnerabilities. 5/

The system didn’t anonymize the records or encrypt them. The only thing protecting patients’ confessions and confidences were a couple of firewalls and a server login screen, ultimately putting them at risk and open to attack. 6/

The Vastaamo scandal has highlighted the “unmet demand” for electronic medical record systems that are scalable, easy to use, and—most importantly—secure. 7/ wired.trib.al/vv5Fagr

News you won't get anywhere else. Subscribe to WIRED. Your first year is only $10: wired.trib.al/f3r0g6N