The first Cypriot hacker to be extradited to the US has pleaded guilty to blackmailing major American website providers with stolen data . Joshua Polloso Epifaniou was a teenager when he began hacking websites, stealing data and threatening to leak it if victims refused to pay a ransom.
The 21-year-old Cypriot hacker, a resident of Nicosia, was arrested by Cypriot authorities in February 2018. In July 2020, Epifaniou was extradited to the US to face charges in both Georgia and Arizona.
According to U.S. authorities, from at least October 2014 to November 2016, Epifaniou searched website traffic rankings to identify targets for extortion. He then worked with co-conspirators to steal personally identifiable information from databases of users and customers belonging to the victim sites.
Among the sites breached by the Cypriot hacker are a free online game publisher based in California, a New York hardware company, an employment site based in Virginia, a consumer reports site based in Phoenix, and an Atlanta, Georgia-based sports news site owned by Turner Broadcasting System Inc.
To steal data, Epifaniou either directly exploited vulnerabilities on the victims’ sites or obtained a piece of data from a co-conspirator who had hacked into the network . Epifaniou then used proxy servers located in foreign countries to connect to accounts and send messages to victims demanding a ransom in cryptocurrency to prevent the stolen data from being leaked.
On January 25, the Northern District of Georgia announced that Epifaniou had pleaded guilty to hacking into several major US-based websites, stealing user data and demanding that the sites' operators pay ransoms to prevent its disclosure.
As reported by Infosecurity Magazine, the Cypriot hacker paid approximately $600,000 in compensation to the victims. He also agreed to pay an additional $389,113 and approximately €70,000 to the US government. His trial is scheduled for March 3, 2021.
