A young hacker who became the first-ever Cypriot citizen to be extradited to the US has pleaded guilty to committing cyber-crimes before a US court in Georgia.
Joshua Pelloso Epifaniou, now 21, was extradited to the US on July 16, 2020, where he faced charges in both Arizona and Georgia for crimes committed from his bedroom in Nicosia when he was still a minor.
The maximum sentence for the charges he faces is 20 years.
“Epifaniou hacked into US-based websites and threatened the disclosure of stolen personal information belonging to users unless the websites paid him large ransoms,” said Acting U.S. Attorney Bobby L. Christine.
“His arrest, extradition, and conviction demonstrate our resolve to bring to justice any hackers, no matter where they reside,” he added.
According to Christine, the charges and other information presented in court: Between at least October 2014 and November 2016, Epifaniou was a teenage hacker in Cyprus who searched website traffic rankings to identify potential targets of his extortion scheme.
After selecting targets, Epifaniou worked with co-conspirators to steal personally identifiable information from user and customer databases at victim websites.
Initially arrested in Nicosia in May 2017 at the age of 17, he spent more than three years in a Cypriot jail without being convicted and fighting extradition.
According to the five-count indictment filed in the Northern District of Georgia, the victim companies include a free online game publisher based in Irvine, California; a hardware company in New York; an online employment website headquartered in Innsbrook, Virginia; and an online sports news site owned by Turner Broadcasting System Inc. in Atlanta, Georgia.
“This conviction represents the determination of FBI investigators to hold cybercriminals accountable for extorting U.S. companies and citizens no matter where they may be hiding,” said Chris Hacker, Special Agent in Charge of FBI Atlanta.
“However, the successful prosecution of this case would not have been possible without the help of our federal and foreign partners, including the government of Cyprus.”
Epifaniou allegedly used proxy servers located in foreign countries to log into online email accounts and send messages to the victim websites threatening to leak the sensitive data unless a ransom was paid.
Prior to his plea, Epifaniou paid nearly $600,000 in restitution to the victims and agreed to forfeit an additional $389,113 and nearly €70,000 to the government in his plea agreement.
Sentencing is scheduled for March 3 with Epifaniou’s lawyers hoping for a minimum sentence that could cover time already served.
“The legal team in the US is hoping to secure a time-served sentence from the Court in Atlanta and a dismissal of the charges in Arizona,” said his Cyprus-based lawyer Michael Chambers in earlier comments to the Financial Mirror.
“We believe that the fact that restitution has been provided and that Joshua has served over three years in prison will be taken into consideration during sentencing,” he said last November.