Cypriot sentenced for email hacking committed as teen
A 22-year-old from Cyprus was sentenced to a year in prison after pleading guilty to computer fraud conspiracy and computer fraud for hacking websites and extorting them for money, the Department of Justice announced Thursday.
The Cypriot, Joshua Polloso Epifaniou, exploited security vulnerabilities to steal sensitive personal information from user and customer databases between October 2014 and November 2016, when he was a teen living with his mother, according to the Department of Justice. Epifaniou used the stolen information to log into email accounts and send messages to victim websites demanding a ransom and threatening to leak the sensitive data.
Epifaniou also obtained information on targets from a co-conspirator who had previously hacked the websites.
Epifaniou targeted a Turner Broadcasting System-owned sports news website in Georgia, a hardware company in New York, an online game publisher in California, a consumer report website in Arizona and an employment website located in Virginia, according to the DOJ.
In coordination with the Office for Combating Cybercrime of the Cyprus Police, Epifaniou — the first Cypriot national to ever be extradited from Cyprus to the U.S. — has been sentenced to prison.
Epifaniou will serve one year and a day in prison, in addition to credit he has already received for serving three years and 10 months before sentencing. Epifaniou has already paid $600,000 in restitution to victims, and forfeiture of $389,113 and 70,000 euros to the government.
Teenage hackers are often accused of committing cybercrimes. Just this week a teen from Florida pleaded guilty to being behind the scheme that hijacked prominent Twitter accounts last year in an effort to steal hundreds of thousands of dollars.
Some European authorities have taken a different approach to teenaged hackers, and instead of threatening legal consequences for suspected first-time offenders, they offer community service and ethical computer training. The program, known as Hack_Right, has been running as an experiment in the U.K. and The Netherlands since 2018, as part of a recognition that teens may be hacking to show off to their friends without knowing the full scope of the legal consequences they may face if caught, and to give them second chances.
A sister program to Hack_Right, called the Cyber Offender Prevention Squad, is launching in Europe this year with a focus on targeting teens at risk of committing cybercrimes before they do, and educating and informing them of hacking laws and alternative ways they can use their skills.
The 18-year-old teen accused in the Twitter case, Graham Ivan Clark, will serve three years in a juvenile facility. Prosecutors have said that will offer him a chance to mend his ways.
