Unmasking an anonymous website through a Cyprus company

In short

If a Cyprus company hosts, pays or processes payments for an anonymous website, a Cyprus court can order it to say who is behind it, for a claim here or abroad.

Klitos Platis, advocate

Your first message costs nothing: within one working day we tell you whether we can help and what it would cost.

Email Klitos Platis WhatsApp Enquiry form

klitos@kleanthousplatis.com

A website copies your work, an account publishes lies about you, or an online seller takes your money, and nothing on the page says who runs it. Someone usually does know: the company that hosts the site, runs the platform, pays it for advertising or processes its payments.

If that company is registered in Cyprus, a Cyprus court can order it to tell you what it knows. Our article on Norwich Pharmacal orders sets out the general law, and our fraud and asset recovery page covers what follows once the wrongdoer is named. This article is about the online case: what the court needs to see, what to ask for and what it costs.

A Cyprus company may hold the name you need

The company that serves an anonymous site usually knows more about its operator than anyone else. It may be:

the host that stores the site or the account;
the platform or marketplace on which the account operates;
the advertising network that pays the site for the advertisements it shows;
the payment provider that collects the money;
the company that supplies the software the operator uses.

It will usually have done nothing wrong itself, and it will be wary of claims from its own customer if it hands over the details without an order. Cyprus courts have accepted that a bank which opposed disclosure for that reason acted reasonably (RCB Bank Ltd v Bank of Cyprus, 2016). The order is what allows the company to answer.

The court’s power to order disclosure

A Cyprus court can order a person mixed up in someone else’s wrongdoing, even innocently, to disclose what it knows, including the names of the wrongdoers. The Supreme Court set out the principles in Avila Management Services Ltd v Stepanek (2012) 1 ΑΑΔ 1403, adopting the English Norwich Pharmacal line of cases. A person who became involved in the wrongs of others so as to facilitate them, even with no personal liability, has a duty to assist by giving full information.

The power rests on section 32 of the Courts Law, Law 14/1960, and on equity. It is not confined to naming a defendant: it extends to the information needed to bring the claim. Nor is it confined to torts. It applies whenever the respondent became mixed up in wrongful acts that infringe the applicant’s rights.

The Civil Procedure Rules 2023 leave this power in place. Rule 31.7 allows disclosure before proceedings only against someone likely to be a party to them, and it is expressly without prejudice to the court’s power to order disclosure by a non-party under any other rule or law. An intermediary you do not intend to sue is reached through the Norwich Pharmacal jurisdiction.

Servers and software are within reach

The Supreme Court has upheld disclosure orders against a software company whose data sat on servers it said it could not open. In MetaQuotes Software Ltd v Dababou (Civil Appeal E324/2016, 14 November 2018), the company argued that it could not reach the information and that the applicant could find it elsewhere. Both arguments failed.

The trial court had appointed an independent computer expert, bound by confidentiality, to carry out the electronic disclosure. The Supreme Court held that this protected the applicant’s rights and removed the risk that other people’s data would be disclosed. Where a company answers that the data are technically out of its hands, that is the order to ask for.

Proceedings abroad are covered

You do not have to sue in Cyprus to use the order. In Avila the Supreme Court held that there is no bar in principle to an order made to obtain information for an action outside the jurisdiction. The applicants there needed documents for a claim in the Czech Republic, where, they said, the procedure offered no disclosure of documents.

The order sets the uses allowed, and the court will not allow uses it has not been told about. In Deposit Guarantee Fund v Alpha Bank Cyprus Ltd (2024) the District Court allowed the information to be used in civil proceedings and arbitrations to be brought in Cyprus or abroad, and forbade its use in any pending proceedings without its leave. In Yegiazaryan v Abacus Ltd (2025) the court refused a general permission to use the material in proceedings in Cyprus and abroad, because the affidavit said nothing about what those proceedings would be.

So the application should say where, and against whom, the action will be brought.

What the court has to see

Three conditions, and the court keeps a discretion even when all three are met. As summarised in Intersafe Abrium SA v Gecina Group Ltd (District Court, 26 June 2014), drawing on Avila:

a wrong has been done, or arguably done, by the ultimate wrongdoer;
an order is needed so that action can be brought against the wrongdoer;
the company was mixed up in the wrong so as to facilitate it, and is able, or likely to be able, to provide the information.

The court will refuse if the information can be obtained another way, or if it is not satisfied that an action against the wrongdoer is really intended. What counts is necessity, not convenience. The order is not made to satisfy curiosity.

In the online case the third condition is shown by records: the hosting details, the payments, the advertising code or the notices that tie the site to the Cyprus company.

Ask for the specific account, not everything

An order that names the accounts and the information sought is easier to grant and easier to obey. Under Article 10(2) of the EU Digital Services Act, Regulation (EU) 2022/2065, an order to an intermediary to provide information about specific users has to identify them clearly, for example by account names or unique identifiers. It can require only information the provider has already collected to provide its service and that lies within its control.

So the application should set out:

the website addresses, account names or identifiers concerned;
the categories of information sought, such as the details given when the account was opened and the payment details held;
the period the request covers.

The company’s own position under Cyprus law

Cyprus law protects an innocent host from liability, but not from a court order. Under section 17 of Law 156(I)/2004, a provider that stores information supplied by a user is not liable for it if it does not actually know it is unlawful, or if it acts quickly to remove it once it knows. Section 17(3) keeps the court’s power to require the provider to end or prevent an infringement.

Section 18(2) of the same Law obliges providers to tell the competent authority of suspected illegal activity by their users and, at the request of the competent authorities, to give information that helps identify the users with whom they have storage agreements. That duty runs to the authorities. It gives a private person no right to the same information, which is why a rights holder or a person defamed applies to the court.

Copyright holders have a statutory route as well

Where copyright is infringed on a commercial scale, the Copyright Law gives the court its own power to order information. Under section 13B of Law 59/1976, in proceedings under that Law concerning commercial-scale infringement, the court may order information on the origin and distribution networks of the infringing goods or services. The order can be made against any person found to be providing on a commercial scale services used in the infringement, and the information can include names and addresses.

That power works inside proceedings already brought. The Norwich Pharmacal order is the tool when there is not yet anyone to sue, and which route fits depends on the stage the matter has reached.

Without tipping off the wrongdoer

The court can stop the company from warning its customer while the matter runs. Cyprus courts have made gagging orders, forbidding a respondent to reveal the proceedings, alongside disclosure orders. In Yukos Capital Ltd v Bank of Cyprus (District Court of Nicosia, 29 November 2017) the court found the need for one evident, and in RCB Bank Ltd v Bank of Cyprus (2016) one had been made without notice before the disclosure application was heard. In Yegiazaryan (2025) the court kept its gagging order in force only for a reasonable time, so that the applicant could assess what was disclosed and act on it.

The disclosure itself is usually decided after the company has been heard. In 2011 the District Court of Limassol refused to make Norwich Pharmacal orders without notice where the harm alleged was the time a hearing would take, because the applicants could apply on notice and be heard (Stepanek v Avila Management Services Ltd, 10 March 2011).

What it costs, and who pays

Expect to pay the company’s costs of the application and of complying, and to claim them back from the wrongdoer. Rule 39.21 of the Civil Procedure Rules 2023 says that, on applications for disclosure before proceedings or against a non-party, the general rule is that the respondent is awarded its costs of the application and of complying with the order. The court can depart from it, taking into account how reasonable it was for the respondent to oppose and whether the parties followed any relevant pre-action protocol.

The courts treat an innocent intermediary the same way in Norwich Pharmacal applications. In Avila the Supreme Court said that awarding costs to a blameless respondent, and even requiring security for its costs and losses of compliance, is not unusual. In Yegiazaryan (2025) the applicant succeeded in part and was still ordered to pay the costs of the two banks, because nothing showed they had knowingly taken part. In Yukos the orders were made on condition that the applicants cover the respondent’s costs of complying.

What this means in practice

Record the website or account now: the addresses, dated screenshots and the material that harms you.
Identify the Cyprus company and the records that connect it to the site or account.
Write to the company and ask. Keep its answer: a refusal shows the court there was no other way, and the court looks at pre-action conduct when it decides costs.
Decide where you will sue once the operator is known, because the order can serve proceedings abroad.
Budget for the company’s costs of complying, and claim them later from the wrongdoer.
Act before the account is closed or the records move on.

If a Cyprus company serves the site, a Cyprus court can make it say who runs it, for a claim here or abroad.

Questions we are asked

The company says data protection stops it from telling me. Is that right?

Not once a court orders it. In Yegiazaryan v Abacus Ltd (District Court of Nicosia, 17 September 2025) the court held that, where fraud appears, the public interest outweighs the interests of the person the data concern, and noted that the data protection laws protect individuals, not companies. Companies resist without an order because they fear claims by their own customer; the order answers that fear.

Can I use what is disclosed in a court outside Cyprus?

Yes, if the order allows it. The Supreme Court held in Avila Management Services Ltd v Stepanek (2012) that there is no bar in principle to an order made to help bring an action outside Cyprus. The application should say where, and against whom, the action will be brought, because the order sets the uses allowed.

Will the person behind the website find out?

Not necessarily before the company answers. Cyprus courts have made gagging orders that forbid a respondent to reveal the proceedings, where warning the wrongdoer would defeat the order, usually for a limited time. Whether one is needed, and for how long, is asked for in the application.

Who pays the company’s costs?

Usually you, at first. Under rule 39.21 of the Civil Procedure Rules 2023 the general rule on disclosure against a non-party is that the respondent recovers its costs of the application and of complying, and the courts take the same view of an innocent intermediary. You can then seek them from the wrongdoer in the action that follows.

What should my first message say?

The address of the website or the name of the account, what it has done to you and since when, which Cyprus company is connected to it and how you know, and what you have already asked of that company. Attach dated screenshots and the links.

Sources

Klitos Platis

Advocate, Partner

Kleanthous & Platis LLC, Cyprus
Published 30 October 2026

Need advice on your own matter?