Cookie Preferences

We use cookies to provide a better user experience and personalised service. By consenting to the use of cookies, we can develop an even better service and will be able to provide content that is interesting to you. You are in control of your cookie preferences, and you may change them at any time. Read more about our cookies.

These cookies are technically required for our core website to work properly, e.g. security functions or your cookie consent preferences.

Preference cookies enable a website to remember information that changes the way the website behaves or looks, like your preferred language or the region that you are in.

In order to improve our website going forward, we anonymously collect data for statistical and analytical purposes. With these cookies we can, for instance, monitor the number or duration of visits of specific pages of our website helping us in optimizing user experience.

These cookies help us in measuring and optimizing our marketing efforts.
Edit cookie settings
Skip to content
sv fi en
Shop Jewellery Watches Coins Banknotes Collecting accessories Literature Orders and decorations Militaria Medals Olympic memorabilia Silver items Other items Auction Next auction Buying at auctions Selling at auctions Grades of preservation and abbreviations Terms of Bidding Evaluation Evaluation of jewelry Valuation of watches Valuation of items Trading gold with trust since 1949 Estates of the deceased For insurance companies About us Contact The HOLMASTO company The Holmasto story Caritha Holmasto – von Schantz in memoriam 1942-2017 Press & Media Blog News

Data breach in Holmasto’s customer register

Updated September 15, 2026

Did you receive a text message from us on September 14, 2026?

The message is genuine and comes from us. It concerned the data security incident that occurred on August 30, 2026. We sent it to you because we do not have your email address stored.

We are sorry that this information only reached you now.

What happened?

A data security incident affected our customer records on Sunday, August 30: a vulnerability was identified in our customer search interface, allowing an external automated system to retrieve a portion of data from our customer register.

The retrieval was interrupted thanks to the search service’s own built-in protection. The data breach affected approximately 70% of our customers. As a precaution, we are informing everyone involved personally.

Communication regarding the data breach

We wanted to reach every person affected personally, rather than relying solely on website announcements and media coverage. We sent a message to everyone using the contact details we have stored for them.

  • September 2, 2026. We published this notice on our website and reported the incident to the Office of the Data Protection Ombudsman.
  • September 2–3, 2026. We sent a personal email to customers whose email addresses we have on file.
  • September 14, 2026. We sent a text message to customers we were unable to reach by email.

We apologize for the delay – we understand that the wait may have been frustrating. Sending the text messages required us to set up a new SMS service, and opening this service took longer than expected.

What measures have we taken?

  • The vulnerability was fixed immediately upon detection, and system data retrieval capabilities have been restricted.
  • We have filed a police report regarding the crime directed against Holmasto. This report does not replace a customer’s own police report if they themselves become a victim of misuse – see Recommended actions below. For the time being, we are not aware of any misuse of data.
  • We have reported the incident to the Office of the Data Protection Ombudsman.
  • We have investigated the scope of the leak in more detail and informed our customers personally about which specific pieces of information regarding them may have been targeted in the breach.
  • We have reviewed the data security of our systems together with our service provider, and identified deficiencies have been corrected.
  • Our customer service team has been responding to inquiries and data requests regarding this matter throughout the investigation.

What data may have been compromised?

Listed below is the information that was stored in our customer records. We have informed each customer in a personal message about which of these apply to them.

  • Email address. Be prepared that phishing emails using your correct information and appearing plausible may be sent to your address.
  • Phone number. Be vigilant regarding unexpected text messages and phone calls requesting your information or urging you to act quickly.
  • Address. Pay close attention to mail received by post that references Holmasto or asks you to confirm your details.
  • Personal identity code. We recommend being extra vigilant regarding potential misuse in the near future.
  • Bank account number. A bank account number (IBAN) alone does not allow money to be withdrawn from your account. However, remain cautious of messages referencing your bank or asking you to confirm information.

Passwords or usernames were not among the compromised data.

Submitted identity documents

Some of our customers have previously submitted a copy of their passport or identity card to us. These files were not in the search service affected by the breach, but in a separate file storage. They are stored at web addresses that cannot be guessed and therefore cannot be browsed.

We still recommend that you remain vigilant regarding potential identity theft and contact the police if you suspect any misuse.

Recommended actions

Be cautious. We recommend that you exercise extra caution and maintain a critical approach toward unexpected emails, phone calls, or messages requesting personal or sensitive information. Do not open suspicious links or disclose your online banking credentials/verification codes to anyone. Neither Holmasto nor your bank will ever ask for them via email or phone.

Consider a voluntary credit ban. You can set up a voluntary credit block free of charge in the Positive Credit Register as well as with credit reference agencies (Suomen Asiakastieto, Dun & Bradstreet).

Contact your bank if necessary. Monitor your bank statements, and if you notice anything unusual, contact your bank. You can also proactively inform your bank that your personal identity code and bank account number may have been compromised.

File your own police report if necessary. Holmasto has filed a police report regarding the incident on its part. If it turns out that your personal details have been misused, or if your bank, lender, or insurance company asks you for a police report – file your own report with the police. This can be done electronically at poliisi.fi or by visiting a police station. You can state in your report that your details were involved in the data breach targeting Holmasto’s customer register on August 30, 2026.

Our own customer communications regarding this matter do not contain links or attachments. If you receive a message in Holmasto’s name containing a link or attachment and asking for your information, it is not from us.

Further information

Holmasto is not aware of any misuse of the leaked data, at least for the time being. Once again, we are deeply sorry for what has happened.

Contact Information

For further information, please contact our customer service team at info@holmasto.fi

Updates

September 15, 2026. Supplemented with details on how and when we informed our customers. Added information about the police report filed by Holmasto as well as instructions on filing an individual police report.

September 3, 2026 Supplemented with details on what information was stored in our customer records.

September 2, 2026 Page published.