Arion Kurtaj, an 18-year-old hacker from Oxford, finds himself sentenced to an indefinite stay in a secure hospital following a major security breach involving unreleased footage of the highly anticipated video game Grand Theft Auto 6 (GTA 6). Kurtaj, diagnosed with acute autism, was a notable member of the international hacking group Lapsus$, infamous for their attacks on prominent tech firms like Nvidia, Microsoft, Uber, and Rockstar Games, causing nearly $10 million in damages.
Despite being on bail for a previous Nvidia hack and under police protection at a Travelodge hotel, Kurtaj executed a significant hack on Rockstar Games. Using an Amazon Firestick, a hotel TV, and a mobile phone, he breached Rockstar’s internal Slack messaging system and leaked 90 clips of GTA 6, which he threatened to release further unless contacted by Rockstar. The leaks included the game’s source code and footage, posted under the alias “TeaPotUberHacker.”
Kurtaj’s trial was unprecedented as his autism led to him being deemed unfit to stand trial in a traditional sense. Instead, the jury was tasked with determining if he was responsible for the attacks, rather than assessing criminal intent. His violent behavior in custody and continued expression of intent to return to cybercrime were significant factors in the trial.
The impact of Kurtaj’s actions was profound, with Rockstar Games reporting a $5 million loss and thousands of hours of staff time spent in recovery. Despite this, Kurtaj’s defense argued that the recent successful GTA 6 trailer release suggested minimal negative impact from the hack. However, the court recognized the broader harm caused by his and Lapsus$’s activities, including attacks on other major tech firms and individuals.
In the same trial, another 17-year-old member of Lapsus$ was convicted, receiving a Youth Rehabilitation Order. Lapsus$, described as “digital bandits,” has been notorious for their bold cybercrimes, often publicly taunting their victims. While Kurtaj and the unnamed minor have been convicted, other members of the group are believed to still be at large. This case highlights the growing concern over sophisticated cybercrimes committed by increasingly younger individuals, prompting a call for strengthened cybersecurity measures in the face of these evolving threats.
