Podcast Summary:

Podcast: BBC Lê
Episode: 'Um hacker roubou as anotações da minha terapeuta – agora meus segredos mais profundos estão na internet para sempre'
Date: February 21, 2026
Reporter: Jenny Kliman (BBC News)
Narration: Silvia Salek

Overview

This episode brings to life the harrowing account of Mary Tully Auer, a Finnish woman whose deeply personal therapeutic records were exposed online following a massive cyberattack on the therapy provider Vastamo. The story highlights the far-reaching personal, social, and legal consequences of one of the biggest data breaches in Finland's history, exploring themes of privacy, trauma, resilience, justice, and recovery.

Key Discussion Points & Insights

The Discovery of the Breach

• Incident Unveiled: Mary Tully Auer receives a chilling email in her spam folder, which includes personal details like her entire name and social security number, confirming it's not a generic scam.
  • "Ele continha seu nome completo e número de seguro social, o equivalente na Finlândia ao CPF brasileiro. O e-mail estava cheio de detalhes sobre ela que ninguém mais deveria saber." (02:05)
• Blackmail Attempt: The hacker threatened to leak her therapy records unless she paid a ransom in Bitcoin: €200 within 24 hours, rising to €500 after that.
  • "Se ela não pagasse... suas informações serão publicadas para todos verem..." (03:00)

Personal Impact and Societal Scale

• Immediate Reaction: Overcome by fear and shame, Auer isolates herself at home and takes medical leave from work.
  • "Tirei licença médica do trabalho, me tranquei em casa, não queria sair, eu não queria que as pessoas me vissem." (03:20)
• Scale of the Breach: 33,000 patients’ records—including confessions of suicide attempts, extramarital affairs, and child abuse—were stolen, affecting a large portion of Finland’s population.
• National Scandal: It quickly became the country’s largest-ever cybercrime, attracting urgent government attention.
  • "O caso se tornou um escândalo nacional, o maior crime cibernético da história da Finlândia." (04:10)

Human Stories in the Aftermath

• Lasting Trauma: Auer recounts her struggle with anxiety and depression, noting that reading her therapist’s leaked notes was devastating.
  • "Eu fiquei magoada com a forma com que ela me descreveu. Me fez sentir pena da pessoa que eu era." (09:40)
• Dark Web Exposure: She tries to find out if her own records are already exposed, discovering people mocking the vulnerability of others online.
  • "Uma criança de 10 anos tinha ido à terapia e as pessoas estavam achando engraçado." (06:40)
• Collective Angst: Many in Finland know someone whose records were stolen, amplifying collective fear and distrust.

Legal Battle for Justice

• Polícia and Perpetrator: After two years, police link the crime to Julius Kivimäki, a known cybercriminal. He is tried and sentenced after extradition.
  • "O réu foi considerado culpado e condenado a seis anos e sete meses de prisão. O sofrimento das vítimas foi reconhecido pelo tribunal..." (08:30)
• Public Trials: So many victims were involved that the legal proceedings were broadcast in cinemas to accommodate collective interest.

Consequences and the Long Shadow

• Privacy Permanently Broken: Even years later, leaked patient files circulate on the Dark Web. A searchable tool was even created to further invade privacy.
• Erosion of Trust: Many former patients vow never to seek therapy again due to the breach of trust.
  • "Há muitas pessoas... que faziam terapia há anos, mas agora nunca mais vão marcar uma sessão." (10:10)
• Tragedy: The breach leads to at least two known suicides among victims, illustrating the immense psychological toll.

Auer’s Path to Agency

• Reclaiming Narrative: Rather than remain a victim, Auer chooses to go public about her ordeal, discusses her story openly with family, and writes a memoir titled "Todos Ficam Sabendo."
  • "Eu transformei tudo em uma narrativa. Pelo menos eu posso contar a minha versão da história, aquela que não está visível nos prontuários dos pacientes." (11:10)
• Enduring Impact: Auer accepts that her secrets are public, but focuses on her wellbeing by owning her story.

Notable Quotes & Memorable Moments

• Auer on her initial reaction:
  "Tirei licença médica do trabalho, me tranquei em casa, não queria sair eu não queria que as pessoas me vissem." (03:20)
• Auer on national impact:
  "Na Finlândia... parecia que todos conheciam alguém que teve seus registros terapêuticos roubados." (04:20)
• Police perspective (Marco Leponen):
  "Esse não é um caso normal." (07:05)
• Auer on reading her own therapist's notes:
  "Eu fiquei magoada com a forma com que ela me descreveu. Me fez sentir pena da pessoa que eu era." (09:40)
• On the collapse of trust in therapy:
  "Há muitas pessoas... que faziam terapia há anos, mas agora nunca mais vão marcar uma sessão." (10:10)
• Auer on sharing her story to heal:
  "Foi muito mais fácil para mim saber que todos que me conheciam já sabiam." (10:50)
• On reclaiming her narrative:
  "Pelo menos eu posso contar a minha versão da história, aquela que não está visível nos prontuários dos pacientes." (11:10)
• Auer’s acceptance:
  "Para o meu próprio bem-estar, é melhor simplesmente não pensar nisso." (11:33)

Timestamps for Important Segments

• [01:19] – Introduction to story and Mary Tully Auer’s breach.
• [03:00] – Ransom email details and emotional reaction.
• [04:10] – Scope of breach and national context.
• [06:40] – The experience of finding leaked notes online.
• [08:30] – Arrest, trial, and verdict against the hacker.
• [09:40] – Auer’s feelings about her therapy notes.
• [10:10] – The ongoing impact on therapy users and trust.
• [11:10] – How Auer claimed her story through a memoir.

Tone and Language

The episode is told in a personal, empathetic, and serious tone. The language is direct and emotional, relaying both the distress and the resilience of the main subject, as well as the collective trauma experienced by many.

This summary provides a comprehensive and engaging overview of the episode, capturing its emotional gravity, ethical insights, and social impact for listeners who have not heard the story.