An alleged cyber-criminal has become the first Cypriot national to be extradited from the Republic of Cyprus to the United States.
Joshua Polloso Epifaniou, a resident of Nicosia, Cyprus, arrived at John F. Kennedy Airport in New York on July 17. The 21-year-old, who is wanted in two US states, was arrested in Cyprus in February 2018.
A five-count indictment filed in the Northern District of Georgia charges Epifaniou with conspiracy to commit wire fraud, wire fraud, conspiracy to commit computer fraud and identity theft, and extortion related to a protected computer.
A second 24-count indictment filed in the District of Arizona accuses the Cypriot of conspiracy to commit computer hacking, obtaining information from a protected computer, intentional damage to a protected computer, and threatening to damage a protected computer.
The first indictment alleges that between October 2014 and November 2016, Epifaniou was part of a threat group that carried out ransomware attacks against a free online game publisher based in California, a New York hardware company, an online employment website headquartered in Virginia, and a sports news website based in Atlanta, Georgia, and owned by Turner Broadcasting System Inc.
Epifaniou and his co-conspirators are accused of gaining unauthorized access to each company's personal identifying information (PII) and threatening to publish the data online unless they received a ransom. The entities allegedly targeted by Epifaniou were defrauded of $56,850 in Bitcoin, while two victims incurred additional losses of $530,000 in remediation costs.
The second indictment accuses Epifaniou of carrying out a brute force attack against Arizona company Ripoff Report. After compromising the company's system, the Cypriot allegedly threatened to publish the private data it contained unless he received $90,000.
It is further alleged that between October 2016 and May 2017, Epifaniou worked with an associate at “SEO Company,” a search engine marketing company based in Glendale, California, to identify companies that might want to pay for the removal of complaints posted about them on Ripoff Report’s website.
Epifaniou and his co-conspirator are accused of using their unauthorized access to Ripoff Report's database to erase at least 100 complaints, charging SEO Company’s “clients” approximately $3000 to $5000 for each removal.
Epifaniou is scheduled to go before US Magistrate Judge Alan Baverman in the Northern District of Georgia today for his arraignment.