Finnish police have issued a wanted notice for convicted Vastaamo hacker Aleksanteri Kivimäki after the country’s Supreme Court refused to hear his appeal, making his prison sentence final.
Authorities said Kivimäki will be arrested and taken to prison when he is found.
The Supreme Court announced on Monday that it would not grant Kivimäki permission to appeal his conviction in one of Finland’s largest criminal cases.
The decision leaves in place a Court of Appeal sentence of six years and 11 months in prison.
Following the ruling, Eastern Uusimaa Police confirmed to Finnish broadcaster Yle that they had issued a wanted notice at the request of Finland’s Criminal Sanctions Agency.
Police said officers have been instructed to detain Kivimäki immediately if they encounter him and transfer him to Vantaa Prison to serve the remainder of his sentence.
Kivimäki’s lawyer, Peter Jaari, told Finnish media that he does not know where his client is.
According to Jaari, Kivimäki is not in prison and is believed to be abroad.
The Court of Appeal delivered its judgment in February, increasing Kivimäki’s prison sentence from six years and three months, imposed by the District Court in 2024, to six years and 11 months.
The appeal court left the convictions unchanged but ruled that the seriousness and scale of the offences justified a longer sentence.
The court found that the crimes were carefully planned, targeted an exceptionally large number of vulnerable victims and were committed for substantial financial gain.
Judges said the offences would ordinarily have justified Finland’s maximum seven-year sentence for the crimes involved.
The sentence was reduced by one month because Kivimäki reached compensation agreements with many victims.
Kivimäki has denied committing the offences.
The Vastaamo case is regarded as the largest criminal case in Finnish history measured by the number of victims.
The cyberattack began in November 2018 when someone unlawfully entered the computer systems of psychotherapy provider Vastaamo and copied its patient database.
The stolen database contained information relating to about 33,000 people.
The breach became public in 2020 after the attacker attempted to extort Vastaamo before demanding money directly from individual patients.
When many victims refused to pay, highly sensitive personal therapy records were published online.
The Court of Appeal convicted Kivimäki of aggravated data breach, aggravated attempted extortion, 20 counts of aggravated extortion, 20,745 counts of aggravated attempted extortion and 9,231 counts of aggravated dissemination of information violating personal privacy.
The appeal court released Kivimäki from pre-trial detention in September 2025 after concluding that the legal grounds for continued detention no longer existed.
Because he had already spent a lengthy period in custody before trial, he had completed most of his sentence before his release.
Following the increase in his sentence earlier this year, Finnish media reported that Kivimäki still had about five months left to serve.
The Criminal Sanctions Agency is responsible for deciding when convicted offenders must report to prison after a final judgment.
HT