Victims of the Vastaamo data leak which exposed the private mental health provider's patient database to the dark web are facing a 29 June deadline to seek compensation from the bankrupt company.
It's now up to victims to decide whether to seek compensation through criminal proceedings or from Vastaamo's bankruptcy estate.
Police have so far received some 25,000 criminal reports in connection with the hacking of therapy centre Vastamo's database.
Leena-Kaisa Åberg, Executive Director of Victim Support Finland (RIKU), said victims will be able to claim compensation from the hackers as the criminal investigation unfolds.
"If the criminal is identified, there will be a trial and victims can seek compensation," she explained.
In addition to the police investigation into the hackers, Finland's Data Protection Ombudsman is also looking into whether Vastaamo breached any EU data protection rules. If it did, Vastaamo, as the owner of the leaked patient database, would also be responsible for compensating injured parties.
The Office of Finland's Data Protection Ombudsman can order the bankruptcy estate to pay a fine to the state. Victims could then apply for compensation from these funds.
The National Bureau of Investigation (NBI) is meanwhile still investigating the data breach. That said, Victim Support Finland is advising victims to monitor police messaging on the matter.
According to Åberg, police will begin hearing victims in the case this year. During these interviews victims will be able to state their compensation demands and whether they want to press charges against the perpetrator.
Victim Support is advising victims to save and share any ransom demands or other correspondence from extortionists with investigators.
No central advocacy
There is no central body seeking compensation for victims. In addition to Victim Support Finland, publicly funded legal aid offices can offer advice to individual victims.
So far one law firm is representing 113 victims on a pro bono basis. However, the firm, Potilasvahinkoapu, said it was not able to add any more victims to its case.
Åberg pointed out that any sums potentially paid out of the bankruptcy estate are likely to be modest.
"People have to decide whether they want to seek compensation from the bankrupt company as it could affect claims from criminal proceedings."
Victims who want to seek compensation directly from Vastaamo should send an email explaining their demands to henkiloasiakkaat.vastaamo(at)fi.dlapiper.com by 29 June.