Tiina Parikka was half-naked when she read the email. It was a Saturday in late October 2020, and Parikka had spent the morning sorting out plans for distance learning after a Covid outbreak at the school where she was headteacher. She had taken a sauna at her flat in Vantaa, just outside Finland’s capital, Helsinki, and when she came into her bedroom to get dressed, she idly checked her phone. There was a message that began with Parikka’s name and her social security number – the unique code used to identify Finnish people when they access healthcare, education and banking. “I knew then that this is not a game,” she says.
The email was in Finnish. It was jarringly polite. “We are contacting you because you have used Vastaamo’s therapy and/or psychiatric services,” it read. “Unfortunately, we have to ask you to pay to keep your personal information safe.” The sender demanded €200 in bitcoin within 24 hours, otherwise the price would go up to €500 within 48 hours. “If we still do not receive our money after this, your information will be published for everyone to see, including your name, address, phone number, social security number and detailed records containing transcripts of your conversations with Vastaamo’s therapists or psychiatrists.”
