Helsinki Education Division Hit by Massive Data Breach in Spring 2024 In spring 2024, the City of Helsinki’s Education Division (KASKO) suffered a severe data breach, exposing sensitive information belonging to hundreds of thousands of individuals. The attack, which began in mid-April, saw threat actors infiltrate the division’s network via an improperly maintained VPN remote access server. Over the course of several weeks, the attackers mapped the intranet, expanded their access, and exfiltrated approximately two terabytes of data in four separate batches—an estimated 750,000 documents, many containing personal and sensitive data. The breach went undetected for an extended period due to gaps in network monitoring and delayed responses to security alerts. Once identified, the city acted swiftly to contain the attack and implement remediation measures. Investigators determined that the incident was enabled by two key vulnerabilities: the unpatched VPN server and the accumulation of excessive, unmanaged data on a network drive over several years. Organizational changes, unclear responsibilities, and lax enforcement of data storage policies further exacerbated the risks. The compromised data included records of learners, city personnel, and third-party partners, raising concerns about potential misuse for identity theft or fraud—though no such activity was detected during the investigation. Identifying all affected individuals proved difficult, particularly for former employees and past learners, and no comprehensive effort was made to notify them. As a result of the investigation, four recommendations were issued, primarily directed at Finland’s Ministry of Finance. These measures aim to address systemic issues in information security governance, including fragmented legislation, unclear compliance obligations, and the need for stronger oversight in the local government sector. The breach underscores the risks of inadequate cybersecurity practices in public institutions handling large-scale sensitive data.