A Cypriot man pleaded guilty to hacking and blackmailing several US companies. Joshua Epifaniou admitted to computer fraud and paid $600,000 in restitution to his victims. He was extradited from Cyprus and will be sentenced on March 3rd.
Epifaniou operated what he described as a “hacking, extortion, blackmailing, [and] bluffing” scheme from 2014 to 2016. Going by aliases that included “Charley Sullivan” and “Richard Charley,” he picked targets based on their Alexa traffic rankings. That led him to several well-known online businesses — including the Turner Broadcasting-owned sports site Bleacher Report, the DIY electronics company Adafruit, and the California-based gaming portal Armor Games.
Epifaniou exploited security vulnerabilities or worked with co-conspirators to access sensitive information from these companies, then demanded a bitcoin ransom in exchange for not publicly releasing it. According to an indictment, he threatened to publish Bleacher Report’s entire user database online, successfully extorting around $19,000 in bitcoin from Turner. (Epifaniou apparently only had access to part of the database, which he received from a conspirator.) Armor Games paid $1,650 in bitcoin after he breached its computer network and threatened to release user account and payment details.
A separate indictment from Arizona mentions that Epifaniou also targeted consumer complaints site Ripoff Report. As part of that scheme, he gained access to Ripoff Report records and targeted companies with “reputation management” services, deleting at least 100 complaints and charging approximately $3,000 to $5,000 for each.
Epifaniou pleaded guilty to one charge of computer fraud conspiracy and another of obtaining information from a protected computer. Each charge carries a maximum of five years in prison, and his plea deal recommends nearly five years in custody followed by three years of supervised release. He has also agreed to work as an undercover investigator for the US government.