Data Breach Targeted at the City of Helsinki

The Safety Investigation Act offers a framework for investigating a so-called exceptional event. The investigation of the data breach is conducted as a special event investigation. According to the Act, such an investigation may concern a very serious event that was not an accident and which resulted in death or that threatened or seriously damaged basic functions in society Safety Investigation Act 525/2011

‍The Finnish Government commissions the investigation of an exceptional event upon proposal by the Minister of Justice.

The purpose of the investigation is to improve general safety. The investigation group is expected to issue recommendations on how to better develop societal preparedness for very serious events, such as data breaches, and to mitigate their effects.

The investigation will focus on:

The investigation will help produce information on how society could better prepare for similar events. Society does not currently have enough information on how to support and instruct citizens in the best possible manner to ensure appropriate follow-up in the event of cyberattacks or security breaches.

The investigation will examine the following:

• the indirect and direct causes of events.
• how safety was to be ensured
• which the roles of different organisations and authorities in ensuring information security were
• how management, supervision and inspection had been taken into account and implemented
• How internal and external communications were implemented.
• How the follow-up with the population subject to the major data breach were implemented; how communications on the event was done.

Safety investigations are not conducted to assign legal responsibility, which means that matters of guilt, responsibility and liability will not be addressed in the investigation.

 The investigation group works independently.

Chief Safety Investigator Hanna Tiirinki from the Safety Investigation Authority, Finland has been appointed Head of the Investigation Group.

Contact details for stakeholder:

If you, as a stakeholder have questions about the investigation and its progress, please contact us :

By telephone: +358 2951 50738 or +358 50345 1931 on Mondays from 14:00 to 15:30 or on Fridays from 10:00 to 11:30

By e-mail: [email protected]
We will respond as soon as possible.

Updates from the #HKItietomurto group
• The group began working immediately after appointment and has contacted several organisations. These organisations’ leadership, specialists and other employees have been asked to describe the data breach and the organisation’s reaction from their viewpoint.
• 5 Jul 2024 The investigation group conducts its first meeting and begins preparing the investigation plan. Measures to acquire investigation material are launched.
• 19 Jul 2024 Information needs of investigative lines are defined, and material acquirement (vai information gathering) continues. Contacting those to be interviewed continues.
• 9 Aug 2024 Investigative lines are further defined. Additional material requests are made.
• 23 Aug 2024 Investigation measures progress as planned.
• 6 Sept 2024 Further information needs and additional interviews are defined.
• 12 Sept 2024 A situational picture of investigative lines is compiled. Communications plan is sharpened.
• 20 Sept 2024 Interviews and the acquisition of investigation material continues.
• 4 Oct 2024 Investigation progresses. Interviews continue and are complemented.
• 11 Oct 2024 Emphasis especially in investigative activities concerning public authorities. Further gathering of investigative material.
• 18 Oct 2024 Advancement of reporting.

Below a letter from the Head of the Investigation Group.