Shell company in Iceland allegedly conceals identities of cybercriminals

A shell company in Iceland is reportedly being used to conceal the identities of cybercriminals, as reported in the New York Times. The company, Withheld for Privacy, is situated at Kalkofnsveg 2 in downtown Reykjavik and is said to exploit Icelandic privacy laws to register domains anonymously, making it challenging to trace the real owners.

Steinarr Kristján Ómarsson, a spokesperson for the Reykjavik Metropolitan Police, noted that this type of shell company has been known to law enforcement for some time. Established in 2021 by an Icelandic law firm, it was soon sold to Sergio Raygoza Hernandez, who is referred to in the Times as its CEO. Hernandez is a lawyer at Namecheap, a U.S.-based domain registration service. Steinarr stated that law enforcement has no record of Hernandez visiting Iceland.

He explained that Namecheap utilizes Withheld for Privacy to register domains while prominently advertising that such registrations will appear as if they are based in Iceland. However, Steinarr emphasized that there are no actual operations occurring in Iceland; the company is merely a front, with all associated data stored elsewhere.

While Icelandic authorities have participated in international law enforcement actions targeting organized crime on encrypted communication platforms, Steinarr clarified that this situation is different, noting that there is no data hosting involved, just domain registration. He indicated that effective solutions would require legal reforms to prevent further exploitation of Icelandic laws, asserting that existing frameworks can be misused without broader regulations in place.