Lessons from Helsinki: NCSC-FI’s Role in Mitigating a Major Data Breach – Source: www.infosecurity-magazine.com

A 2024 data breach affecting Helsinki, Finland’s capital and largest employer, which exposed sensitive personal data of over 300,000 people, offers valuable lessons for cybersecurity professionals.

The incident was the subject of a year-long investigation by the Safety Investigation Authority of Finland (SIAF/OTKES), which published its technical report on June 17, 2025.

Matias Mesia, a senior specialist at Finland’s National Cyber Security Centre (NCSC-FI), led the agency’s task force that helped Helsinki recover from the breach.

During FIRSTCON in Copenhagen on June 23, he shared insights into the incident and the strategies employed to contain and mitigate the breach, providing practical guidance for others facing similar cybersecurity challenges.

Insights on Helsinki’s 2024 Data Breach

With around 40,000 employees and a budget of €4-5m ($4.6-5.8m), Helsinki is not only the capital and biggest city of Finland, attracting 12% of the country’s population (686,595 residents in March 2025), but it is also the country’s largest employer.

At 11.30 pm on April 30, someone from the City of Helsinki filed a report to NCSC-NI about a potential data breach. Following early media reports the next day, Helsinki issued a public disclosure on May 2, stating that the breach affected the Education Division of the organization, known as KASKO.

Within days of an investigation from the City of Helsinki, NCSC-FI, and a private digital forensics and incident response (DFIR) partner, the infected device was identified. It was a Cisco ASA 5515 firewall appliance used by KASKO as a receiving router for VPN connections. The piece of hardware was installed in 2014 and was last updated in 2016. In 2017, the people responsible for the device left the organization.

The attacker’s modus operandi was also identified early on in the investigation. It began with brute force attacks, followed by a vulnerability exploit via a remote connection between a user’s computer and the router, utilizing Cisco AnyConnect software. The device crashed, allowing the attacker, who was logged in with credentials found on the dark web, to move laterally within the internal systems and gain privileged access to Microsoft Active Directory, a virtualization server and a backup server, thereby stealing data.

While Helsinki quickly realized that the amount of data was considerable (approximately 10 million documents, or 2TB of data had been stolen), it initially believed that 120,000 people could be affected, before reevaluating the number to 15,000 and then to over 300,000 people.

The victims included a wide range of people, such as city employees, childcare benefit applicants, private schools staff members, students in integration training and students born between 2055 and 2018 and their relatives.

“However, we knew early on that no passwords had been compromised and that no ransom demand had been issued,” said Mesia during his FIRSTCON talk.

Additionally, no attribution has been made to this day. “Police forces are still investigating the case,” Mesia told Infosecurity after the session.

Role of NCSC-FI in the Incident Response Process

The Helsinki data breach was among the 18 cases treated by NCSC-FI with the highest level of involvement, which the agency refers to as ‘special cases.’

NCSC-FI started helping the City of Helsinki on May 9, 2024, allocating between 10 and 20 staff members until June 2024, with half of them focusing on the technical remediation and the rest on various tasks such as compliance, communication and data breach reporting.

Among its various contributions, NCSC-FI advised the City of Helsinki on the investigation, helped it plan a press conference, provided custom scenarios and coordinated an expert seminar with management teams and security specialists from Finnish municipalities at the end of May 2024.

On May 30, 2024, NCSC-FI staffers held an internal ‘lessons learned’ session tackling five areas, which later took the form of five thematic ‘lessons learned’ reports:

• Organization, coordination and leadership report
• Case coordination report
• Technical report
• Legal report
• Communication report

NCSC-FI members continued to provide IT technical guidance to the City of Helsinki until the end of June, when the case “calmed down,” as Mesia put it during FIRSTCON.

“We also published a 40-page document on how to create an efficient incident response task force,” Mesia added.

In July 2024, the SIAF started its own forensic investigation.

Lessons learned and Upcoming Developments

Speaking to Infosecurity, Mesia shared his top three learnings from the Helsinki case:

• Cyber incidents involving the compromise of edge devices, especially unpatched or obsolete ones, should be treated as critical incidents
• Organizations should prepare for the logistics of an incident response and business continuity process, including setting up which communication tools they want to use and setting up operational templates
• Organizations should include a range of different profiles in their task force, including people with experience of previous cyber incidents and people with no experience

Additionally, during his talk, the NCSC-FI senior specialist shared some personal tips for incident responders:

• Keep your chats clean – no memes, no chit-chat
• Cooperate and delegate tasks
• Use timelines, especially to explain what is happening/has happened to the leadership team
• Scan your networks over and over again
• Share information about the incident outside your bubble – to the broader organization and the public – as someone will fill the information vacuum if you don’t
• Handle the information with care
• Respects politics and media

Finally, Mesia shared with Infosecurity that the Helsinki case prompted the NCSC-FI to develop a new three-tier system for attributing cyber incidents, in order to determine how much effort the agency should invest – and therefore how many NCSC-FI personnel should be working on the case.

While still in development, the framework could categorize incidents into three priority levels: medium priority, with a handful of NCSC-FI staff members working on the case; high priority, with up to 10 NCSC-FI individuals working on the case; and critical priority, with over 10 people from NCSC-FI dedicating their time to remediate the incident.

“I think that we could have a nice presentation ready for next year’s FIRSTCON to introduce this upcoming framework,” Mesia announced.