I realize this "Therapy centre hack suspect faces..." is the original title, but it's a bit of a garden path sentence. I had to read it twice to parse it correctly.

A title for a different article:

"Therapy centre hack suspect faces, aggravated blackmail, other charges: three noun phrases without a conjunction."

There's supposed to be hack suspect faces, but I only see a picture of one face in the article.

This is actually quite common in Finnish, since there is no strict word ordering. Once you have figured out all the words and their agglutinations, you can put them in any order. Many phrases don't parse until you heard all of it.

Alternatively, “Suspect in therapy centre hack faces aggravated blackmail, other charges”

> faces aggravated blackmail, other charges

Charged with aggravated blackmail.

Other than the hard to parse title, what's interesting here? "Alleged hacker faces charges for crimes" doesn't seem overly noteworthy.

It was a bad idea to store all that information in machines connected to the internet.

There was speculation in earlier thread about the case that suspect was active hn user https://news.ycombinator.com/item?id=34670385

According to court documents a HN comment thread is part of the evidence.

Is it possible to read Finnish court documents online? I think I responded to this guy on here a while ago so I'm curious.

I don't think they're available online, in the general case. Court documents are public by default in the sense that they must be provided on request (exceptions can be made) but I think only supreme court judgements are directly readable online.

This case is in district court.

Additional context from HS: https://www.hs.fi/kotimaa/art-2000009931214.html

The suspect is accused of stealing tens of thousands of sensitive psychotherapy patient records from a MySQL server exposed to the public internet, using what I presume to be a weak MySQL (root) password.

The suspect is then accused of ransoming first the private healthcare provider, and then the individual patients (using the stolen email addresses). The ransomer went public and started leaking the patient records in batches of 100, before prematurely leaking the entire set by accident. The records contained what I believe included full detailed records from the individual psychotherapy sessions.

The company was aware of the breach, but did not report it before the attacker went public. There was, if I recall correctly, some kind of crypto locker compromise that brought their systems down, but those were only reported as some form of technical maintenance gone wrong.

Harder to find a source for it because the older articles are paywalled, but the IT employees responsible for the systems were not charged, instead the CEO was convincted of some form of criminal negligence. Plus financial fraud for selling the business without disclosing the earlier breach.