Both suspects—Joshua Polloso Epifaniou, 21, a resident of Nicosia, and Ghassan Diab, 37, a citizen of Lebanon—were arrested earlier last year and extradited to the United States last weekend.
According to the indictment, Epifaniou conducted a brute force attack against the Phoenix-based online review portal Ripoff Report (ROR) in October 2016 and successfully override ROR's login and password protection to gain access to its database through an existing account associated with a ROR employee.
In November 2016, Epifaniou tried to extort the company by emailing ROR's CEO with a hyperlink to a video demonstrating Epifaniou's unauthorized access to the ROR CEO's account, threatening him to publicly disseminate stolen ROR data unless he paid $90,000 within 48 hours.
Between October 2016 and May 2017, Epifaniou also worked with an associate at Glendale-based "SEO Company" to illegally remove complaints posted on ROR's website for whoever interested in paying the company approximately $3,000 to $5,000 per complaint removal.
According to the court documents, Epifaniou and his co-conspirator removed at least 100 complaints from the compromised ROR database for their "clients," which could have profited the SEO Company somewhere between $300,000 and $500,000.
Besides ROR, Epifaniou has also been accused of hacking and extorting websites between October 2014 and November 2016, which included:
- a free online game publisher based in Irvine, California;
- a hardware company based in New York;
- an online employment site headquartered in Innsbrook, Virginia; and
- an online sports news website owned by Turner Broadcasting System Inc. in Atlanta, Georgia.
To hack into these websites, Epifaniou either directly exploited a security flaw in it and stole its user and customer data, or obtained a portion of the victim website's user data from a co-conspirator who had hacked into the victim network.
Epifaniou allegedly defrauded the victim websites of $56,850 in bitcoin, and two victims incurred losses of more than $530,000 from remediation costs associated with the incident.
Epifaniou is wanted in both the Northern District of Georgia and the District of Arizona. He is charged in the District of Arizona in a 24-count indictment with conspiracy to commit computer hacking, obtain information from a protected computer, intentionally damage a protected computer, and threaten to damage a protected computer.
In the Northern District of Georgia, Epifaniou is charged in a five-count indictment with conspiracy to commit wire fraud, wire fraud, conspiracy to commit computer fraud and identity theft, and extortion related to a protected computer.
Epifaniou is scheduled for his arraignment before the U.S. Magistrate Judge Alan J. Baverman in the Northern District of Georgia, on Monday, July 20.
Another Cypriot, named Ghassan Diab, 37, extradited on Friday and wanted in Florida, has been identified by the U.S. Justice Department as a member of Hezbollah, a militant group based in Lebanon.
Diab is conspired to engage in the laundering of drug proceeds, money laundering of more than $100,000, conspired to launder a further $100,000, as well as accused of the unlicensed transmission of currency of over $100,000, and unlawful use of a two-way communications device to further the commission of money laundering.
Diab is charged with a total of 8 federal counts, all felonies under Florida law.
