Chapter 4
Threats, extortion and criminal investigation
Published on
While the previous chapters describe reputational pressure and attempts to interfere with Ventus Energy’s business operations, the events unfolding in parallel increasingly escalated into direct intimidation, extortion attempts and activities that ultimately resulted in law enforcement involvement.
The cyberattack
One of the earliest serious incidents occurred approximately 48 hours after Karsten’s first publication.
On December 4, 2025, a cyberattack targeted the accounting company servicing one of Ventus Energy’s powerhouses — PH Dambis. The accounting infrastructure was breached.
The attack targeted a specific accounting workstation where several years of accounting data related to Ventus Energy-associated entities had been stored. The data was damaged and encrypted during the attack.
Notably, although the accounting company serviced multiple businesses, only Ventus Energy-related data was affected.
Fortunately, the accounting company maintained backup systems, meaning the attack did not result in significant operational disruption.
Extortion demands
Shortly after the cyberattack, Ventus Energy received a threatening message from individuals claiming responsibility for the attack. The message stated that the sender had carried out the breach and demanded 1 BTC in exchange for restoring the encrypted data.
In the days following the cyberattack, additional threatening communications directed at Ventus Energy partners connected to the lending business continued.
As Ventus Energy did not respond to the extortion demands, the situation escalated further.
On December 15, 2025, the company received another direct extortion demand — this time requesting EUR 250,000.
As the threats intensified, Ventus Energy began actively preparing materials and evidence for submission to law enforcement authorities and seeking institutional protection.
The “media murder” offer
Later, in March 2026, an experienced P2P industry professional contacted one of Ventus Energy’s closest partners and claimed to know who had allegedly financed actions targeting Ventus Energy.
According to the information received, up to EUR 250,000 had allegedly been promised to a person willing to organise a “Ventus Energy media murder”.
While we cannot independently verify every statement connected to these communications, all related information formed part of the broader set of materials later submitted to law enforcement authorities.
Criminal proceedings begin
Following the evaluation of available facts and evidence, Estonian law enforcement authorities initiated criminal proceedings connected to these events.
Due to the active criminal investigation, we are currently limited in the amount of evidence and investigative material that can be publicly disclosed.
However, the escalation did not stop there.
Intimidation and surveillance
On March 25, 2026, a package containing a cut-off pig’s head was delivered to Ventus Energy’s office in Estonia.
Several days later, company owners received additional threatening communications through WhatsApp together with photographs showing Jānis Timma kids next to kindergarten and Henrijs Jansons’ vehicle parked next to the company’s office.
The messages created a clear impression that physical surveillance and monitoring activities had taken place.
Moreover, the financial demands escalated further, with threatening messages through WhatsApp, demanding an increased amount to 20 BTC.
By this stage, the situation had clearly escalated far beyond aggressive criticism, online commentary or reputational attacks.
The combination of extortion demands, intimidation, operational interference and apparent physical surveillance represented a direct threat not only to Ventus Energy and its management, but also to the broader stability of the company’s operations and ongoing project development activities.
Many of the facts, communications and materials connected to these events now form part of the ongoing criminal proceedings.