Blackmail

[Muukalainen]

I'll start with the facts, at least as they are known at the moment. There is a health care company over here called Vastaamo that provides psychotherapy services nationwide to what must be many tens of thousands of people. It seems that their customer database was hacked at the end of November 2018, and apparently again some time in the following few months. The information stolen included personal contact details, social security number, etc., as well as consultation notes. I presume that Vastaamo themselves remained unaware of the data breach until September just gone when the hacker contacted them demanding money on threat of publishing the personal data on the internet. This threat was carried out last Friday when the personal information of some 300 people, some of them minors, was published. Additionally, people -- the quantity of victims is already in the thousands -- have been receiving similar blackmail e-mails demanding money with menaces. A good friend of ours received such an e-mail. She's been having a difficult time since her daughter was killed by an out of control car on her way home from school some years ago. And now she's got this unspeakable cunt to deal with.

The police seem lost in space at the moment, though that's hardly surprising. I presume that KRP (central criminal police) were informed of events by Vastaamo in September and then everything went quiet until last Friday when the shit truly hit the fan. They're currently being swamped by reports of the blackmailing e-mails. One aspect that they are looking at is the quality of the Finnish in these e-mails to try to glean some information about the blackmailer(s). It seems to me that one or more Finns have to be involved at some point due to needing to make sense of the information that was stolen, as well as the writing of the e-mail.

In English: https://yle.fi/uutiset/osasto/news/p...of_us/11612622

[Nocturnal Submission]

Grim. Must be awful for your friend.

The long gap between the hacking and the release of the information is a bit odd though. I wonder if the ransom demand came a lot earlier than the company have said and that they've been stringing the hackers along ever since.

[Muukalainen]

That's one possibility NS, though another is that once he'd got the information he didn't know what to do with it. Maybe he had to formulate a plan and then spend some time testing it.

[Nocturnal Submission]

Yup, that occurred to me too. Or possibly that the hacker had no interest in exploiting what he or she had stolen but then, further on down the line, sold or passed on the the data to someone who did.

Anyway, let's hope that they nail the bastard(s) sharpish before they cause any more misery.

[diggedy derek]

Wow.

[pebblethefish]

Makes you realise how lucky we were. When they hacked this site and we didn't pay the enormous ransom, all they took were our pound signs and umlauts.

[Antepli Ejderha]

This is awful. I'm lost for words at how low some people will go.

[Nocturnal Submission]

Pebble will say anything to get a laugh.

[MsD]

These sort of blackmailers are a bit like the scam artists - they send out a load of threats/requests, if one or two bite then they've made their money. My guess would be if your friend doesn't bite they will go elsewhere.
I hope so.
It is a despicable way to make money.

[caja-dglh]

New York DMV just pulled a move on me.

Seven years after I left NY and moved to CT, they have decided to put a block on my Drivers License for expiration of Insurance (the car was licensed and insured in CT). Pay the $50 and they will let me renew my drivers license.

The whole state structure for these things is such a racket. Looks like Cuomo has NY looking down the back of the sofa for revenues.

[Paul S]

The term Black Mail comes from the Borders area between England and Scotland by people called Reivers. There used to be a tax called White Mail and there were people who would steal your cattle. Then they realised it would be easier to just threaten people they would steal their cattle unless they paid them some money and this became known as your Black Mail.

The word bereavement also comes from the Reivers - Be-Reived.

[Moonlight Shadow]

I have received a number of emails with a password that I use on some sites, probably from the MySpace hack, in the subject with a blackmail request, always the same... apparently they have a recording of me masturbating on some porn taken from my laptop camera and unless I send some bitcoins, all my friends and colleagues will get an email with said video...

(No, I do not masturbate whilst watching porn on a laptop....)

[ad hoc]

(No, I do not masturbate whilst watching porn on a laptop....)

What do you do then? Take notes? Criticise the camera angles?

[MsD]

Yes, I get tons of emails accusing me of pleasuring myself in front of the laptop. I am, admittedly, stroking *a feline creature* on my lap much of the time.

[Moonlight Shadow]

What do you do then? Take notes? Criticise the camera angles?

I write angry essays about the objectification of the body in our decadent society...and also how much silicone you can stuff in a pair of boobs...

[ChrisJ]

I've had those emails too - always a helpful reminder to check whether I'm still using that password.

As lightly as I take it now (like I don't remember to cover the camera with bit of bluetac!), I do recall how shocked and anxious I was the first time. It really was a genuine, if old password. What else did they have? I knew they didn't have video of me, but had they got access to my machine or other accounts?

I can only imagine the horror those poor sods in Finland are feeling at the moment. There is a special circle in hell reserved for people who prey on people who are doubly vulnerable like that.

[Janik]

These sort of blackmailers are a bit like the scam artists - they send out a load of threats/requests, if one or two bite then they've made their money. My guess would be if your friend doesn't bite they will go elsewhere.
I hope so.
It is a despicable way to make money.

This case does seem a bit different as they have already released some people's personal information to the world. In many cases, such as the webcam takeover/porn claims, they are fronting on nothing but not here, or at least not in every case. Much easier to not bite when you know that it is an obviously false claim ("what webcam would that be, then?").
But yes, the advice must be not to bite. Because how would biting help? If the blackmailer knows person x is desperate enough to pay to prevent this being made public, are they going to fulfill their side of the 'bargain' and destroy the information? Hardly. Not that logicking this out this helps the victims any - it just makes them feel even more powerless and vulnerable. There is literally nothing they can do to stop themselves being exposed - it is entirely the in the scumbags control.

This one is about as despicable as it gets, isn't it? Right up their with 'revenge porn' in terms of sheer invasiveness. We need some sort of 'virtual rape' laws that carry very substantial jail terms for these sorts of criminality.

[Paul S]

What do you do then? Take notes? Criticise the camera angles?

Every so often on OTF there is a comment which makes me laugh out loud and this is one of them.

[Muukalainen]

The long gap between the hacking and the release of the information is a bit odd though.

it turns out that the company was aware of the data breach by March 2019, but decided that the best course of action was to sweep it under the carpet. The irony being that there aren't any carpets over here. They didn't even bother to inform the new owners when the company was sold later that spring. Unsurprisingly, these people are now hopping mad, have started legal proceedings against the former owners and sacked the CEO, who was incumbent at the time of the sale and appraised of the security breaches.

In English: https://yle.fi/uutiset/osasto/news/v..._half/11614603

[Ginger Yellow]

it turns out that the company was aware of the data breach by March 2019, but decided that the best course of action was to sweep it under the carpet.

That's a pretty serious breach under GDPR. They can be fined up to 10m.

[Posty Webber]

I believe that in Oz you only need to report a breach if you know data has been stolen. Which isn’t always achievable, and is therefore a loophole.