HBO is set to release a series about Finnish hacker Aleksanteri Kivimäki in September.
One of Europe`s most wanted cybercriminals is now the subject of a documentary series. Warner Bros. Discovery announced that in September, HBO Max will premiere a four-part project titled `Most Wanted Criminals: The Teen Hacker`, focusing on the Finnish hacker Aleksanteri Kivimäki, who is currently serving a six-year sentence.
«He gained notoriety after forcing an American passenger plane to make an emergency landing, taking down PlayStation globally, and excelling in phone terrorism,» the company`s press release stated.
Kivimäki is perhaps best known for hacking the database of a Finnish psychotherapy clinic network, as well as the social media account of billionaire Elon Musk on platform X (formerly Twitter). He committed his first crime at the young age of 11.
Kivimäki Was Caught Due to His Love for Alcohol
At 7:20 AM on February 3, 2023, French police arrived at a modern apartment building in the Parisian suburb of Courbevoie, on the left bank of the Seine. They were responding to a report of potential domestic violence. On arrival, they were met by a young woman who explained that she had been out late the previous night with a friend and her husband. The husband had consumed too much alcohol, a conflict erupted, and the friends went their separate ways.
Towards morning, the caller started to worry that her friend might be in danger. The police knocked on the door for a long time, but no one opened, so they decided to enter by force.
The couple the police found inside were clearly still recovering from drinking, but there were no signs of violence.
They were asked to show identification and presented Romanian passports. While the woman resembled a native of that country, the 193cm tall blonde man with blue eyes looked nothing like a person named Asan Amet; furthermore, he had a clear Northern European accent. Checking the list of Europol`s most wanted fugitives, the police found a match. This is how, because of a simple argument with his wife, Aleksanteri Kivimäki, who had been sought across the continent for several years, was finally apprehended.
Vengeful Hacker Pursued His Victims for Years
In childhood and adolescence, Kivimäki was more often called by his middle name, Julius. He was born in 1997 in Espoo, a suburb of Helsinki. His first introduction to the family computer was at the age of three, but a career as a computer genius – at least in the way his parents dreamed – didn`t materialize. Kivimäki not only didn`t attend college but also failed to finish high school.
However, in the latter half of the 2000s, he joined the forum «Hack the Planet». Its participants, most of whom were far from adulthood, hacked corporate networks, favoring technology giants or companies specializing in information security. After doing so, they published all the data they could access.
«We were just kids playing,» Kivimäki recalled years later. He denies having any significant importance within the ranks of Hack the Planet, but within the community, the Finn was well known under the nickname Zeekill. His break with his comrades occurred in 2011 when the 14-year-old teenager fell out with another young hacker, American Blair Strater. The formal reason for the conflict was a heated argument about the publication terms for the Hack the Planet magazine.
I often got into online conflicts. After all, I was just an autistic kid who enjoyed being nasty online.
Blair Strater, Hacker
Because of this, both were expelled from Hack the Planet, but Kivimäki did not stop and began to take revenge on the American. Initially, he simply ordered food delivery to his former comrade`s home address in Illinois at the most inconvenient times. After that, he bought and dumped three tons of gravel in front of his house under Strater`s name. Then Kivimäki found a way to constantly disconnect his opponent`s internet and electricity, and eventually crossed the line completely. First, he hacked the American`s mother`s social media page and, posing as her, posted many racist and anti-Semitic messages, causing the woman to lose her job.
And then Zeekill called the local police station, introduced himself as Strater, and «confessed» to murdering his girlfriend, adding that he would then kill his parents and finally blow up the entire block. After this, the American spent three weeks in custody, but the harassment continued for several more years.
At 16, Kivimäki Attracted the Attention of the FBI
Soon, Kivimäki found new like-minded individuals from another teenage group, Lizard Squad. Many of them spent time on the online platform Darkode, where malicious software could be downloaded, stolen data bought and sold, or darknet jobs found. There, Kivimäki met 20-year-old Brit Vinnie Omari, who distributed tasks among users. Their range was extremely wide – from fixing server security vulnerabilities to spying on suspicious spouses and stealing data from websites. Performers were often paid serious money – up to tens of thousands of dollars.
Kivimäki and Omari neglected online security rules and even met in person a couple of times. Once in Amsterdam, they jointly used drugs and then went to dinner. However, most of the time they spent online, playing World of Warcraft and League of Legends for hours. And, of course, hacking more and more targets.
In 2013, Kivimäki finally attracted the attention of law enforcement. When the 16-year-old arrived in the USA for the Black Hat cybersecurity conference, Federal Bureau of Investigation agents raided his hotel room. They confiscated the teenager`s smartphone and laptop and demanded that he never appear in the country again.
A few weeks later, Finnish police visited Kivimäki, raiding his home in Espoo. He was taken into custody and subjected to severe interrogations, and evidence of many crimes was found on his devices. In particular, it became known that together with his partners from Hack The Planet, he had hacked over 50 thousand servers.
Over the next year, he was alternately released and detained again. Zeekill didn`t understand the hint: with renewed energy, he and his Lizard Squad partners began searching for new victims. These included the servers of League of Legends and gaming platforms Microsoft Xbox, Sony PlayStation, and Twitch, as well as the accounts of billionaire Elon Musk and his company Tesla on the social network X.
And on Christmas 2014, he decided to ruin the holiday for those who received new gaming consoles by crashing the Xbox Live and PlayStation Network servers using DDoS attacks. In his comment to Sky News, barely concealing his face, he stated that by doing so, he «forced kids to spend time with their families instead of playing.»
In parallel, the Finn continued to practice phone terrorism. Once, a girl who refused to talk to him received a call from her father`s number: a robot set up by Kivimäki said he was going to commit suicide, and sounds of gunshots played in the background.
But his favorite target became Sony Online Entertainment President John Smedley. In August 2014, Kivimäki read on his X page that he was planning to fly home to San Diego. The criminal found out the flight information and called American Airlines, impersonating Smedley himself. He said he had reason to believe that an impostor with a bomb had boarded the plane using his passport and ticket.
Two fighter jets intercepted the plane carrying the real Smedley mid-flight, after which the aircraft was forced to make an emergency landing in Phoenix, where the company head was interrogated by FBI agents for a long time.
The Hacker Believed He Was Impune
In July 2015, a Finnish district court found Kivimäki guilty of money laundering, numerous counts of fraud, cyberbullying, and involvement in 50,000 data breaches. He was also charged with hacking Harvard University and the Massachusetts Institute of Technology. It was also revealed that the Finn had stored and used stolen credit card data. But because he committed the crimes as a minor, the sentence was lenient even by Finnish standards – two years suspended. The state confiscated his Acer laptop and made him pay a fine of 6.5 thousand euros.
Kivimäki received in 2015
Kivimäki changed the bio section on his X profile, adding the phrase «Untouchable god of hackers». He left Finland to live first in Barcelona, then in London, where he rented luxurious apartments for himself and his girlfriend. He traveled extensively, visiting the UAE, Hong Kong, the Czech Republic, and, of course, Romania. He visited Nepal and skied in the French Alps, and at one point even got married.
In June 2020, Kivimäki appeared in court for the second time. This time – for phone terrorism. And again, he got off with a suspended sentence. A few months later, the 23-year-old Finn committed the biggest hack of his life. The victim was the Finnish psychotherapy clinic network Vastaamo. On September 28, 2020, the company received a ransom demand via email. The author greeted them in Finnish but wrote the rest in English. The tone itself was audacious but extremely polite.
«Any money you pay us will seem insignificant compared to the damage that will be done to your business if we publish this data online,» Kivimäki wrote. «If you have any questions or difficulties understanding what`s happening, I`m here to help.»
Kivimäki requested as ransom
The company refused to pay, and the cybersecurity experts they hired concluded that Vastaamo had been extremely negligent in data security. The hacker`s haul included tens of thousands of patient records: medical charts with diagnoses, treatment plans, and most importantly – session notes with all the revelations.
To pressure Vastaamo into cooperating, Kivimäki threatened to publish a hundred records daily on a hacking forum. He did so, trying to select patient stories that mentioned words like «police», «rape», «pedophilia», «rape fantasies». From there, the data quickly spread to regular forums, chats, and bulletin boards.
This continued for three days, after which the hacker suddenly published the entire bulk of private information about 30,000 patients. For tiny Finland, with a population of 5.5 million people, this was a shock. The country`s government convened an emergency meeting, and the president and members of parliament compared the leak to an act of terrorism, calling it ruthless and cruel.
Everyone knows someone who knows someone whose information has been disclosed.
Mikko Hyppönen, Cybersecurity researcher
As it would later turn out, Kivimäki was too lazy to spend time manually publishing data daily and tried to set up an automatic export, but made a mistake, uploading the entire home folder of the server where his program was running. He deleted the 10 gigabytes of uploaded data, but by then, hundreds of people had already copied it. Realizing his blunder, Zeekill began sending emails to the patients themselves, extorting… 200 euros from them for non-disclosure. Some victims agreed, but their data was never deleted.
Meanwhile, the police began an investigation. Analysts studied the materials Kivimäki mistakenly published and found much information unrelated to the Vastaamo hack. Soon, they managed to track the servers the hacker used, and then him – despite the Finn always being careless about his own security. Due to the slowness of the local system, the warrant for his arrest was only issued in October 2022. Four months remained until the fateful drinking session in Paris.
The Third Sentence Was Real
In late February 2023, Kivimäki was extradited to Finland and placed in Vantaa prison, located half an hour`s drive from his parents` home. As the investigation proceeded, new details of the hacker`s carelessness surfaced. For example, he uploaded Vastaamo patient data without using a VPN from the same London IP address from which he paid for subscriptions to OnlyFans and other online services.
Another IP address was traced to an apartment in Barcelona rented by a man named Daniel Fulgescu. A BMW 7 Series driven by Kivimäki was registered under the same name, and he posted photos of it online under the nickname «Aleksanteri K», praising a high-class car service in Barcelona.
On November 13, 2023, Kivimäki`s third trial began in his hometown of Espoo, but no one believed in a suspended sentence anymore.
The charges included aggravated computer break-in, dissemination of private information, 20 counts of extortion, and over 21,000 attempted extortions. The court even allowed the Finn to spend part of the required time under house arrest. But the leniency ended there – in April 2024, he was sentenced to 6 years and 3 months in prison.
