Finnish prosecutors have charged a second individual — U.S. national Daniel Lee Newhard — with attempted extortion of the Vastaamo psychotherapy center. 

The Finnish Prosecution Service announced on Monday it had charged Newhard with aiding and abetting attempted aggravated extortion. It said the suspect, a 28-year-old, denies the offense. Officials did not specify if he was in custody.

It follows Aleksanteri Kivimäki, the Finnish cybercriminal convicted of more than 20,000 counts of attempted extortion over the Vastaamo incident, being released from custody last week as he appeals his case.

While Kivimäki is the primary suspect, earlier this year, the National Bureau of Investigation said it was also probing the suspected involvement of a resident of Estonia who was believed to have been involved in the extortion targeting the psychotherapy center, as well as the dissemination of its client information on the internet.

A cached version of a since-closed entrepreneur profile on the Estonian site Inforegister records a Daniel Lee Newhard with the date of birth of 23/03/1997, making him 28 years old. Pasi Vainio, District Prosecutor of the Prosecution District of Western Finland, confirmed to Recorded Future News that Newhard was a U.S. national. The case against Newhard will be heard at the District Court of Western Uusimaa.

Finnish prosecutors said they have decided to waive the charges of aiding and abetting the dissemination of information because the cost of doing so would be “disproportionate to the nature of the case and the potential sanctions that could be expected.” They added that the charges facing Newhard relate solely to attempted extortion against Vastaamo itself rather than its clients.

Court documents state that Newhard was a user of a server managed by Kivimäki that was used in the hack and extortion of Vasttamo and its clients. They allege that the server logs “contained an IP address that can be connected to the internet connection used by Newhard in Estonia and to his home address.”

Kivimäki, who denied all the charges against him, has been in custody since 2023, when he was arrested in France and extradited to Finland. His release on appeal last week does not overturn his previous conviction and sentence for six years and three months, but under Finnish law he is presumed innocent while appealing the conviction.

His freedom is the latest chapter in one of Europe’s most significant criminal data privacy cases, with the hacker — who previously had been convicted as a teenager for his involvement with the “griefing” collective Lizard Squad — found guilty of attempting industrial-scale extortion against the clients of the Vastaamo therapists.

Lawyers representing his victims told journalists this week that their clients are still suffering as a result of the hack. As a whole the case “has deeply shaken Finnish society,” according to a feature-length report about the incident in the Christian Science Monitor, where the hack was described as “a watershed event for Finland.”

The hack of Vastaamo took place in 2018, but was made public in 2020 when Kivimäki allegedly began to extort individual patients by threatening to publish their stolen information and therapy details online unless they paid him.

More than 24,000 people reported receiving such an extortion attempt to the Finnish police — a record number of victims in a criminal trial. According to reports, many of the victims were children or receiving treatment for severe trauma.