180
classic opsec mistake
(discuss.tchncs.de)
so, the company was Vastaamo. was because it got bankrupt after the breach, and GDPR violations.
the "hacker"(or rather cracker) was extradited from France to Finland.
you can read about how terrible the company's security was here: https://tietosuoja.fi/en/-/administrative-fine-imposed-on-psychotherapy-centre-vastaamo-for-data-protection-violations
or watch mental outlaw's video on the matter, or the Wikipedia article on the breach.
now there are several things that shouldn't have happened (e.g.: don't do these things on your main OS, have root access disabled, etc.), but I'll leave that to you experts.
Hackermans
it's almost as if company begged to get hacked. but imagine the horror those people whose data was leaked had to go through. they open up to their psychologist and now everyone knows about it.
As soon as I first heard about services like betterhelp and their competitors, I knew it was a terrible idea.
Therapists have to keep records of everything you say to them, and if it's a big-tech owned service like that that's already getting hacked every other hour, do you think it's safe to have intimate details of your personal problems in a database like that?