An 18-year-old hacker who was instrumental in leaking Grand Theft Auto VI footage has been sentenced to life in hospital imprisonment by a UK court. On Thursday (December 21), a British judge determined that Arion Kurtaj poses a high risk to the public because he continues to wish to commit cybercrime, BBC reported. The teenager hacked into Rockstar servers without using a computer and posted clips and source codes for the upcoming GTA-VI, while he was in police custody.
Kurtaj, a key member of the international gang Lapsus$, was found guilty of cyberattacks on GTA VI developer Rockstar Games and other companies, including Uber and Nvidia, by a London jury in August. However, because Kurtaj suffers from autism and was declared unfit to stand trial, the jury was asked to decide whether he committed the crimes in question, rather than whether he did so with criminal intent.
It was reported that accused Kurtaj leaked 90 videos of GTA-VI gameplay footage while on bail for hacking Nvidia and British telecom operator BT / EE last September. Despite staying in a hotel under police protection at this time and after police confiscated his laptop, Kurtaj was able to attack Rockstar Games without using a computer. He carried out the attack using the room’s Amazon Fire Stick and the TV, a newly purchased smartphone, a keyboard, and a mouse. Following the incident, Kurtaj was arrested.
He stole 90 clips of the unreleased and hugely anticipated Grand Theft Auto 6, and released them on social media, along with some source code. Before posting them, he threatened to release GTA source codes if Rockstar does not contact him. He broke into the company’s Slack messaging system to deliver the threat, saying, “if Rockstar does not contact me on Telegram within 24 hours I will start releasing the source code”.
Kurtaj then posted the clips and source code on a GTA forum under the username TeaPotUberHacker. He posted 90 videos from a test build of Grand Theft Auto 6, running with “GTA 5 and 6 source code and assets”. The legitimacy of the videos was confirmed by Rockstar. After this, he was again arrested.
After the hearing, the court sentenced him to spend his life in a hospital. The judge said Kurtaj’s skills and desire to commit cybercrime meant he remained a high risk to the public. Judge Patricia Lees said that the ‘only safe option’ was to detain him under section 37 of the Mental Health Act with a restriction order.
Kurtaj will remain at a secure hospital for life unless doctors deem him no longer a danger. He will be transferred to a secure psychiatric hospital in next month once a bed is available at Marlborough House medium-secure hospital in Milton Keynes.
The court also noted that he had been violent during police custody, and there are dozens of incidents of injuries and property damages caused by him. A mental health assessment of the accused said that he continued to express the intent to return to cyber-crime as soon as possible, prompting the unique sentencing by the court.
Meanwhile, another 17-year-old Lapsus$ member received an 18-month community punishment, known as a Youth Rehabilitation Order, along with a prohibition from accessing virtual private networks (VPNs). This youth, who can’t be named, suffers from ASD (autism spectrum disorder), and was sentenced to a youth rehabiliation order for 18 months earlier for hacking offences.
Even after several videos leaked by Kurtaj and the trailer’s premature release on X (Twitter), the official trailer for GTA VI received hundreds of millions of views. Currently, the trailer has clocked around 155 million views on YouTube.
While Kurtaj’s counsel asked the judge to consider the trailer’s success during the sentence, the BBC reports that the judge noted that Lapsus$ harmed real businesses and people. Rockstar Games told the court that it spent $5 million to recover from the hacking attack. Prosecutor Kevin Barry said that the attacks on Rockstar, Nvidia and Uber resulted in damages of £7.4m ($9.3m) for the companies.
Kurtaj and the 17-year-old are the first Lapsus$ members to be convicted, although it is believed that others are still out on the loose. The gang’s attacks in the years 2021 and 2022 stunned the cyber-security community. The group from the United Kingdom and Brazil was dubbed “digital bandits” in court.
The gang assumed to be primarily comprising teenagers, utilised con-man techniques as well as computer hacking to get access to multinational firms such as Microsoft, the technology behemoth, and digital banking firm Revolut. In their rampage, the hackers publicly boasted their crimes and ridiculed victims on the social network app Telegram in English and Portuguese.
