A soon as Meri-Tuuli Auer saw the subject line in her junk folder, she knew it was no ordinary spam email. It contained her full name and social security number—the unique code Finnish people use to access public services and banking.
The email was full of details about Auer no one else should know.
The sender knew she had been having psychotherapy through a company called Vastaamo. They claimed to have hacked into Vastaamo's patient database and demanded Auer pay €200 (£175) in bitcoin within 24 hours, or the price would increase to €500 within 48 hours.
If she did not pay, they wrote, 'your information will be published for all to see, including your name, address, phone number, social security number and detailed patient records containing transcripts of your conversations with Vastaamo's therapists.'
That's when the fear set in, Auer, 30, shared with BBC News. I took sick leave from work, I closed myself in at home. I didn't want to leave. I didn't want people to see me.
Auer was one of 33,000 Vastaamo patients held to ransom in October 2020 by an anonymous hacker.
The hacker had shared their most intimate thoughts with therapists, including details about suicide attempts, affairs, and child sexual abuse.
In Finland, a country of 5.6 million, the incident was a national scandal, forcing the then Prime Minister Sanna Marin to convene an emergency meeting of ministers to discuss a response, but it was already too late to stop the hacker.
Before sending the ransom emails, the hacker had published the entire stolen patient database on the dark web, an untold number of individuals having accessed the sensitive information.
Auer had confided deeply personal aspects of her life to her therapist—secrets she hadn't even shared with her closest family members, including struggles with alcohol and a secret relationship with an older man.
Instead of breaking her, Auer's experience led her to recognize her own resilience.
„Everybody seemed to know someone who had their therapy records stolen,” Auer said. „This hack made me realize that I was much stronger than I thought I was.”
To cope with the aftermath, Auer later confronted her trauma by writing a book, Everyone Gets to Know, reclaiming her story amidst the very public scandal.
As Auer learns to live with the ongoing exposure of her secrets, she focuses on the progress she's made, sharing her journey to help others understand the ramifications of mental health data breaches in today's digital age.
