A teenager behind the notorious hack which saw footage of the unreleased Grand Theft Auto VI game leaked online has been detained indefinitely under the Mental Health Act.
Arion Kurtaj, 18, a “key player” in the Lapsus$ group, carried out a hacking spree against major tech firms including Rockstar Games, the developer of the hugely successful video game franchise.
He stole codes and footage of the unreleased Grand Theft Auto VI, the long-awaited sequel which is due to hit the shelves next year more than a decade after the last instalment.
Kurtaj published some of the stolen footage on online forums and blackmailed developer Rockstar, threatening to release the source code unless they contacted him in September last year.
Judge Patricia Lees said the “hacking resulted in a huge loss of marketing opportunities for Rockstar which was unquantifiable” and cost the firm $1.5m (around £1.2m) in external help alone, along with thousands of hours of work by employees.
Kurtaj also targeted broadband provider BT and mobile operator EE, software company Nvidia and Uber – making multi-million dollar demands – over a 14-month period between July 2021 and September last year while he was aged 16 and 17.
Psychiatrists had assessed Kurtaj, who is autistic, as unfit to enter pleas to charges or stand trial.
But a jury found he had carried out the acts alleged against him, which amounted to 12 offences – including six counts of carrying out an unauthorised act to impair the operation of a computer, three counts of blackmail, two fraud offences, and of failing to comply with a section 49 notice to disclose a key when he did not give up the password to his mobile phone when asked to by police – following a two-month case.
Kurtaj was sentenced alongside a 17-year-old boy, who cannot be named because of his age, who pleaded guilty to one offence under the Computer Misuse Act and one count of fraud, and was found guilty of one count of fraud, a charge of blackmail and having carried out an unauthorised act to impair the operation of a computer.
“You two were key players in what was a spree of cyber offending by a hacking group calling itself Lapsus$,” the judge said.
“That group targeted large technology companies and subjected them to hacking, blackmail and fraud.”
The court heard the youth was a member of the group between July 2021 and February last year when he was aged 15 and involved in offences against EE/BT and Nvidia – a hack which cost the company $5m (almost $4m) in remedial costs.
The judge said the youngster, who has been diagnosed with autism, also carried out an “audacious hack” into the City of London police system to view CCTV footage.
The teenager was also convicted of fraud and stalking offences in the youth court after using the email addresses of international government officials to send emergency disclosure requests to companies including Discord, Google and Uber to obtain personal details of those he targeted, the court heard.
He was handed a youth rehabilitation order, including an 18-month supervision requirement and a six-month prohibited activity requirement to stop him using a VPN.
