Aleksanteri Kivimäki

Early Life and Online Activity

Aleksanteri Tomminpoika Kivimäki, formerly known as Julius Aleksanteri Tomminpoika Kivimäki, was born on August 22, 1997, in Finland. Operating under the online aliases "zeekill" and "ryan," he became involved in cybercriminal activity during his mid-teens, attracting the attention of law enforcement in both Finland and the United States before reaching adulthood.

Early Crimes and Lizard Squad

During 2014, Kivimäki engaged in a series of criminal acts that drew international attention. He made false emergency calls — a practice known as swatting — targeting three American families, falsely claiming situations involving hostages, shootings, or explosives, and prompting police units to be dispatched to their homes. Among the targets were close relatives of an FBI agent who had investigated him. On August 24, 2014, he fabricated a security threat against an American Airlines flight traveling from Dallas to San Diego, impersonating a passenger using that person's real information. The airline diverted the aircraft to Phoenix airport, and the U.S. Air Force scrambled two fighter jets in response.

Around the same period, Kivimäki was a member of Lizard Squad, a hacking collective that became widely known for high-profile distributed denial-of-service (DDoS) attacks against gaming services including PlayStation Network and Xbox Live during Christmas 2014. He participated in media interviews in which he discussed the group's activities. Due in part to his age, he was not imprisoned at the time.

Conviction as a Minor

Kivimäki was also connected to a separate cybercriminal group known as HTP, or Hack the Planet. Finnish authorities charged him with operating a botnet comprising more than 50,000 compromised computers attributed to HTP. In July 2015, he pleaded guilty to 50,700 counts of aggravated computer break-ins and related offenses. As a minor, he received a suspended two-year sentence.

Vastaamo Data Breach

In 2018, Kivimäki hacked into the databases of Vastaamo, a major private psychotherapy provider in Finland, gaining access to the therapy session notes and treatment records of approximately 33,000 patients. In 2020, he demanded a ransom of roughly €370,000 in bitcoin from the company. When Vastaamo refused, he turned to extorting individual patients directly, demanding payments of between €200 and €500 per person to prevent the publication of their private records.

The breach resulted in charges of over 21,000 counts of attempted aggravated extortion, nearly 9,600 counts of aggravated invasion of privacy, and 20 counts of aggravated blackmail.

Arrest and Trial

After Finnish authorities identified Kivimäki as the perpetrator, his location was unknown for an extended period. Interpol issued a Red Notice in October 2022. In February 2023, French police responding to a domestic disturbance call in Paris discovered Kivimäki living under a false identity with forged documents. He had been living a peripatetic lifestyle, spending time in Saint-Tropez in southern France, and also had a permanent residence in London, England. He told investigators he had also spent time in Kyiv, Ukraine, the United Arab Emirates, and Barcelona, Spain, before his arrest. He was subsequently extradited to Finland.

In April 2024, the Western Uusimaa District Court found Kivimäki guilty and sentenced him to six years and three months in prison. He announced plans to appeal the verdict.

Appeals and Release

In September 2025, the Helsinki Court of Appeal released Kivimäki from custody, citing the length of time he had spent in pretrial detention as grounds for his release, while upholding his conviction.

Media Coverage

A four-episode documentary series titled Most Wanted: Teen Hacker, produced as a Max Original, premiered on HBO Max on September 5, 2025, examining Kivimäki's criminal history and the Vastaamo case.