Young hacker Joshua Epiphaniou has been sentenced by a US court to 12 months and a day in prison, on top of the nearly four years he has already served in custody since his 2017 arrest in Cyprus.

“Cybercrime is a threat to both our individual privacy and to the security of American companies,” acting US Attorney Anthony Martin said after the sentence was issued overnight Cyprus time. “We will work diligently alongside our law enforcement partners to ensure any perpetrators are identified and brought to justice.”

Epiphaniou’s lawyer in Cyprus Michael Chambers told Cyprus Mail he received a call from him at 4am on Thursday, after becoming aware of his sentence.

“He sounded in good spirits and said he was fine with the outcome of the trial. Realistically, he did not expect a shorter sentence at this point,” he said.

Chambers added that Epiphaniou would most likely be out of prison in 10 months with good behaviour.

“Also, he would only be transferred to a federal prison in two months. Until then, he will remain in a holding facility in Georgia,” the lawyer added.

The 21-year-old, who has also been diagnosed with Asperger’s, was extradited to the US in July 2020 where he faced charges in both Arizona and Georgia for felonies committed from his bedroom in Nicosia when he was still a minor. He is the first Cypriot national extradited from Cyprus to the US.

According to the indictment, between 2014 and 2017 Epiphaniou worked with others to steal personal data from a number of databases in order to extort the websites into paying ransoms under threat of public disclosure.

He then used proxy servers located in foreign countries to log into email accounts and send messages to the victim’s websites threatening to leak the sensitive data unless a ransom was paid in bitcoin.

Victims of Epiphaniou’s cyber crimes included an online sports news website in Atlanta, Georgia, a free online game publisher based in Irvine, California, a hardware company based in New York, New York, an online employment website headquartered in Innsbrook, Virginia, and a consumer report website, headquartered in Phoenix, Arizona.

As a result of his conviction, Epiphaniou forfeited $389,113 and €70,000 to the government and paid $600,000 in restitution to the victims of his fraud.

“Part of the sum that Joshua had to forfeit and pay back was converted from cryptocurrencies. The sentence took into account the growth in value of the sum over the years and converted into current values,” Chambers explained.

“This individual was preying on people for his own personal gain,” Special Agent in Charge of the FBI Phoenix Field Office Sean Caul said.

“FBI agents, analysts and support staff worked tirelessly on this case. This investigation should send a strong message that the FBI has a long reach and no matter where you are, we will continue to leverage all available resources and utilise partnerships in the United States and foreign partnerships to identify criminals in an effort to bring justice to victims of crime”.