Cypriot Hacker Sentenced to Prison

 PHOENIX, Ariz. – Joshua Polloso Epifaniou, 22, of Nicosia, Cyprus was sentenced today in the Northern District of Georgia by U.S. District Judge Mark H. Cohen to 12 months and one day in prison, on top of the nearly four years Epifaniou has already served in custody since his arrest in Cyprus in May 2017. Epifaniou pleaded guilty to federal computer fraud charges brought in Arizona and the Northern District of Georgia. As a result of his conviction, Epifaniou forfeited $389,113 and 70,000 euros to the government and paid $600,000 in restitution to the victims of his fraud. Epifaniou is the first Cypriot national ever extradited from Cyprus to the United States.

“Cybercrime is a threat to both our individual privacy and to the security of American companies,” said Acting U.S. Attorney Anthony Martin. “We will work diligently alongside our law enforcement partners to ensure any perpetrators are identified and brought to justice.”

Between October 2014 and May 2017, Epifaniou hacked websites and monitored online traffic to identify targets for extortion. After selecting target websites, Epifaniou worked with co-conspirators to steal personally identifiable information from the websites’ databases. Epifaniou then used proxy servers located in foreign countries to log into email accounts and send messages to the websites threatening to leak the sensitive data unless a ransom was paid in cryptocurrency. 

Victims of Epifaniou’s computer terrorism included an online sports news website owned by Turner Broadcasting System Inc. in Atlanta, Georgia, a free online game publisher based in Irvine, California, a hardware company based in New York, New York, an online employment website headquartered in Innsbrook, Virginia, and a consumer report website, Ripoff Report, headquartered in Phoenix, Arizona.

After extorting Ripoff Report, Epifaniou also hacked into its website to remove online complaints at the request of paying clients. Epifaniou and his co-conspirator, Pierre Zarokian, charged clients between $1,000 and $5,000 for each complaint removal and falsely told clients that the removals were court-ordered. Epifaniou was charged by indictment in Arizona in CR-17-1280-SMB and Zarokian was sentenced last year in CR-18-1626-MTL.

“This individual was preying on people for his own personal gain,” said Sean Kaul, Special Agent in Charge of the FBI Phoenix Field Office. “FBI agents, analysts and support staff worked tirelessly on this case. This investigation should send a strong message that the FBI has a long reach and no matter where you are, we will continue to leverage all available resources and utilize partnerships in the United States and foreign partnerships to identify criminals in an effort to bring justice to victims of crime.”

The Federal Bureau of Investigation conducted the investigation in this case. Foreign law enforcement partners also made significant contributions to the investigation, including the Office for Combating Cybercrime of the Cyprus Police. The U.S. Attorney’s Offices for the District of Arizona and for the Northern District of Georgia handled the prosecution, with assistance from the Criminal Division’s Office of International Affairs.

CASE NUMBER: CR17-00327-MHC-JKL
RELEASE NUMBER: 2021-014_Epifaniou