City of Helsinki data breach may impact all learners from Helsinki within the scope of compulsory education

The City of Helsinki was targeted with a serious data brach, which the City became aware of on 30 April 2024. The City has prepared press releases on the matter previously, on 2 May and 13 May 2024. As the investigation into the data breach proceeds, it has been discovered that the impact of the data breach may extend to all learners from Helsinki within the scope of compulsory education, as well as their guardians, i.e. also including private schools and educational institutions. The City and the other authorities recommend that you begin actively securing your personal data, even though the investigation into the data breach is still ongoing. Up-to-date instructions for securing your personal data are available at suomi.fi. As per the City’s knowledge, a previous notice on the Wilma system for private school and educational institutions had erroneously stated that the data breach had no impact on the private institutions.

Based on the investigation, it is possible that the data breach may also impact learners from Helsinki in contractual schools as well as private and state-operated schools, private upper secondary schools and vocational schools. The City of Helsinki has a database on persons of compulsory school age from Helsinki, and their guardians, based on the City’s duty to keep records on compulsory education. This database was located on a City of Helsinki network drive, which was a target of the data breach. The Data Protection Act requires the City to notify the possible targets of the data breach. We are unable to identify individual customers who may be affected by the data breach, and as such, the method of contact will be the public website at hel.fi/databreach. We have also published a press release on the matter on 21 May 2024: : Ongoing investigation shows wider target group for the City of Helsinki data breach.

It is possible that the perpetrator has gained access to the personal data of all learners born in 2005–2018 from all schools and educational institutions in Helsinki, as well as the data of their guardians. Additionally, this group also includes all learners from Helsinki in home schooling and students from Helsinki who study in another city. Students who have applied for weighted curriculum education are also included in this group. This set of data included the following information on learners from Helsinki born in 2005–2018 and their guardians:

- Personal IDs of the child and guardian.

- Addresses of the child and guardian (no phone numbers or email addresses). No addresses, phone numbers or email addresses of persons with a non-disclosure restriction were included.

- Native language of the child.

- Nationality of the child.

- Religious community of the child (evangelical Lutheran / orthodox / registered religious community / not part of a religious community).

The City’s investigation into the breach will continue in cooperation with the authorities and further information will be shared as the investigation proceeds. The Helsinki Police Department and the National Bureau of Investigation are investigating the case as an aggravated computer break-in. The victim of the crime is currently the City of Helsinki, from whom the police receive all necessary information for the investigation of the case. In this stage of the investigation, city residents do not need to contact the Police. Information and help are available

This data breach will certainly raise many questions among city residents. There is a comprehensive information package on data breach protection on the Cyber Security Centre website. Help and assistance is also available for persons affected by the data breach from our data breach customer service, crisis emergency services and through MIELI Mental Health Finland. · The City’s website at hel.fi/databreach includes the public release and other instructions for possible target groups of the data breach.

· City of Helsinki customer service for data breach targets, Mon–Fri at 8 am–6 pm, tel. +358 9 310 27139 or [email protected] (opens in default email client) · Traficom Cyber Security Centre: Advice for victims of identity theft or data breaches (link leads to external service) · Suomi.fi, Guides, Data leak(link leads to external service) · Expert tips on how to deal with being targeted by a data breach

The City will notify learners in early childhood education, basic education and upper secondary education, their guardians when progress is made in the investigation.

Satu Järvenkallas Head of Education Division City of Helsinki