This is why the data breach of the city of Helsinki was carried out – 2024-05-13 19:41:03

Security expert Petteri Järvinen does not believe that the party that hacked the city of Helsinki broke into the system to test the city’s security.

The purpose is probably the desire to benefit financially.

– The hacker looks for information in the data that can easily be converted into money. These are, for example, credit card numbers, says Järvinen.

According to Järvinen, it is difficult to comment on the data breach directed at the city of Helsinki, because very little has been reported to the public about it.

Based on what is known now, according to Järvinen, it is not a new Vastaamo.

– This is not quite a similar case, even though the number of victims is large. Most of the information a hacker gets is basic stuff like contact information. Of course, there are also sensitive documents among them, says Järvinen.

Järvinen urges everyone who has been the target of a data breach to be careful

– Monitor the traffic of bank accounts and credit cards, Järvinen instructs.

Data security expert Petteri Järvinen believes that the hacker is trying to benefit financially from the data breach. JOEL MAISALMI

Data moves

The data breach happened on May Day.

Järvinen believes that the files obtained in the data breach have not yet been made public anywhere. The city of Helsinki has also not said whether there has been an attempt to extort it.

Even if the hacker had kept the information he got his hands on until now, things may change.

– Data can end up in very unpleasant places via hacker forums. It is possible that someone uses personal data obtained from a data breach to commit damage, even if the data breacher himself does nothing with it, says Järvinen.

The employee made a mistake

The city of Helsinki announced that a hacker got into the system “by exploiting the vulnerability of the remote connection server.”

According to Järvinen, a data breach into Kela’s systems in this way, for example, is not possible.

– In general-purpose cloud services, there is a risk that the user will fall for a scam message and enter the credentials. It allows the hacker to gain access to the network. Cheating the user is the critical factor here.

Damages

Järvinen does not want to speculate about the possible legal consequences of a data breach.

– Information security has not been criminalized. Yes, damage can always happen. Sanctions are now about whether things have been done safely, whether employees have been properly trained and whether they have been instructed. Even if everything is fine, it is always possible that someone will go cheap, says Järvinen.

Claiming damages is still possible.

– Yes, you can apply for damages for this, if you can show that the leaking of data has caused you measurable harm. Proving it is another matter. You should ask a lawyer rather than an engineer for more information on this matter, says Järvinen.

Either way, a small act had a big consequence.

– Today, one wrong click can cause great damage to 80,000 people, states Järvinen.

– This is a sad thing, but it’s not worth losing sleep over.

Edited on May 13, 2024 at 9:12 p.m.: Removed the point where it was suspected that the data breach was caused by an employee clicking on a scam link.