Finnish police suspect espionage in a major cyber data breach targeting government ICT provider Valtori in late January 2025, involving over 50,000 mobile devices.

Cyber & Information WarfareCyber AttacksData theft / leaks

Aggressor

Summary

In late January 2025, Finland's central government ICT service provider Valtori suffered a significant data breach, suspected by police to involve espionage alongside aggravated data breach offenses. The incident exposed data from over 50,000 government mobile devices, including prosecutors, ministries, and potentially other entities. Compromised information included personal data such as names, work emails, phone numbers, technical device details, and country-level location data, although no emails or images were accessed on the devices. The National Bureau of Investigation is conducting a preliminary investigation to clarify the course of events and identify the perpetrator, with statements from Valtori's Deputy Director General Hannu Naumanen and NBI Detective Inspector Aku Limnell highlighting the serious information security risk posed.

Classification

Confidence: High

The event clearly describes a hostile cyber intrusion targeting Finland's central government ICT services with suspected espionage, investigated by Finnish police and the National Bureau of Investigation; no defense preparations or responses are described in detail.

Source URL

https://yle.fi/a/74-20221844

Open source

Provenance

Publisher: extension
Submitted: Apr 21, 2026, 14:45 UTC
Last updated: Nov 10, 2026, 02:40 UTC
Event time: Jan 31, 2025, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "bbac92b9-8934-4666-a27e-badab61aad56",
  "url": "https://yle.fi/a/74-20221844",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Data theft / leaks",
  "country": "Finland",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "cyberattacks",
    "espionage",
    "data breach",
    "Valtori",
    "Finland",
    "government",
    "mobile devices",
    "NBI investigation"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [
    "Finland"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "Finnish police and the National Bureau of Investigation (NBI) are investigating a major data breach at Valtori, the central government's ICT service provider, which occurred in late January 2025. The breach has been initially classified as aggravated data breach and now also suspected as espionage. Data from over 50,000 government mobile devices was exposed, including information related to prosecutors, government ministries, and possibly other entities. Stolen data includes personal information such as names, work email addresses, phone numbers, technical details of mobile devices, and location data, but no emails, images, or device content were compromised. Valtori’s Deputy Director General Hannu Naumanen described the breach as a significant information security risk. The ongoing investigation aims to determine the exact nature of the stolen information and identify the perpetrator, led by Detective Inspector Aku Limnell.",
  "summary_short": "Finnish police suspect espionage in a major cyber data breach targeting government ICT provider Valtori in late January 2025, involving over 50,000 mobile devices.",
  "summary_extended": "In late January 2025, Finland's central government ICT service provider Valtori suffered a significant data breach, suspected by police to involve espionage alongside aggravated data breach offenses. The incident exposed data from over 50,000 government mobile devices, including prosecutors, ministries, and potentially other entities. Compromised information included personal data such as names, work emails, phone numbers, technical device details, and country-level location data, although no emails or images were accessed on the devices. The National Bureau of Investigation is conducting a preliminary investigation to clarify the course of events and identify the perpetrator, with statements from Valtori's Deputy Director General Hannu Naumanen and NBI Detective Inspector Aku Limnell highlighting the serious information security risk posed.",
  "actor_primary": "Valtori",
  "target_primary": null,
  "location_text": "Valtori, central government ICT services provider",
  "location_region": "Helsinki",
  "location_coordinates_lat": 60.1695,
  "location_coordinates_lon": 24.9354,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event clearly describes a hostile cyber intrusion targeting Finland's central government ICT services with suspected espionage, investigated by Finnish police and the National Bureau of Investigation; no defense preparations or responses are described in detail.",
  "event_time_utc": "2025-01-31T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-21T14:45:01.064Z",
  "updated_at": "2026-11-10T02:40:28.245Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "low",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: LowIndependence confirmedTime: Same dayLocation: Approximate

Source reliability

Info credibility

Event time

Jan 31, 2025, 00:00 UTC

Event time confidence

pm24h

Location

Valtori, central government ICT services provider

Region

Helsinki

Primary actor

Valtori

Country

Finland

Countries

Finland

Tags

cyberattacks, espionage, data breach, Valtori, Finland, government, mobile devices, NBI investigation

Nodes

Node 2: 5th Column

Loading signal...

{ "id": "bbac92b9-8934-4666-a27e-badab61aad56", "url": "https://yle.fi/a/74-20221844", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Data theft / leaks", "country": "Finland", "source_reliability": "B", "info_credibility": "3", "tags": [ "cyberattacks", "espionage", "data breach", "Valtori", "Finland", "government", "mobile devices", "NBI investigation" ], "nodes": [ "Node 2: 5th Column" ], "countries": [ "Finland" ], "where_text": "Cyberspace", "headline": null, "description": "Finnish police and the National Bureau of Investigation (NBI) are investigating a major data breach at Valtori, the central government's ICT service provider, which occurred in late January 2025. The breach has been initially classified as aggravated data breach and now also suspected as espionage. Data from over 50,000 government mobile devices was exposed, including information related to prosecutors, government ministries, and possibly other entities. Stolen data includes personal information such as names, work email addresses, phone numbers, technical details of mobile devices, and location data, but no emails, images, or device content were compromised. Valtori’s Deputy Director General Hannu Naumanen described the breach as a significant information security risk. The ongoing investigation aims to determine the exact nature of the stolen information and identify the perpetrator, led by Detective Inspector Aku Limnell.", "summary_short": "Finnish police suspect espionage in a major cyber data breach targeting government ICT provider Valtori in late January 2025, involving over 50,000 mobile devices.", "summary_extended": "In late January 2025, Finland's central government ICT service provider Valtori suffered a significant data breach, suspected by police to involve espionage alongside aggravated data breach offenses. The incident exposed data from over 50,000 government mobile devices, including prosecutors, ministries, and potentially other entities. Compromised information included personal data such as names, work emails, phone numbers, technical device details, and country-level location data, although no emails or images were accessed on the devices. The National Bureau of Investigation is conducting a preliminary investigation to clarify the course of events and identify the perpetrator, with statements from Valtori's Deputy Director General Hannu Naumanen and NBI Detective Inspector Aku Limnell highlighting the serious information security risk posed.", "actor_primary": "Valtori", "target_primary": null, "location_text": "Valtori, central government ICT services provider", "location_region": "Helsinki", "location_coordinates_lat": 60.1695, "location_coordinates_lon": 24.9354, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The event clearly describes a hostile cyber intrusion targeting Finland's central government ICT services with suspected espionage, investigated by Finnish police and the National Bureau of Investigation; no defense preparations or responses are described in detail.", "event_time_utc": "2025-01-31T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-21T14:45:01.064Z", "updated_at": "2026-11-10T02:40:28.245Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "low", "attribution_basis": "independent_sources" }