Asper Biogene, a genetic testing company based in Tartu, Estonia, was breached in the autumn of 2023 in what the country's Data Protection Inspectorate described as the largest health data leak recorded in Estonia to that point.
The company alerted the police, the State Information System Authority and the Data Protection Inspectorate on November 11, 2023, after receiving a ransom demand that threatened to publish the stolen data and damage its reputation. The inspectorate registered the alert on November 15, and the Southern Prefecture criminal bureau opened an investigation.
Around 100,000 files, roughly 33 gigabytes covering records from 2009 onward, were copied out of the company's database, affecting an estimated 10,000 people. The records held names, Estonian personal identification codes, testing orders, results and condition details. Pille Lehis, director general of the Data Protection Inspectorate, said the stolen material included paternity tests, fertility tests and testing for genetic conditions, and that the damage would have been contained had the data been encrypted or pseudonymized.
More than 40 healthcare providers had sent samples to Asper Biogene. East Tallinn Central Hospital, the North Estonia Medical Centre and Elite Clinic were among the most affected. Affected individuals were to be contacted by their own healthcare providers rather than by the laboratory, and Estonian officials warned the public not to pay any ransom demands.