Arion Kurtaj is an 18-year old hacker who has been identified as a “key player” in the group. Kurtaj has been involved in a series of high-profile cyber attacks against tech companies, one of which was Rockstar Games (a video game developer).
He took codes and footage from the unreleased game, which is set to be released next year, more than ten years after the last Grand Theft Auto. Kurtaj posted some of the footage on social media and contacted developer Rockstar in September of last year, threatening to reveal the source code if the company did not respond.
According to Judge Patricia Lees, the “hacking” led to a “massive loss of marketing opportunities” for Rockstar that was “unquantifiable” and “cost the company $1.5 million (approximately £1.2 million) in external assistance”, “in addition to thousands of hours of labour”.
Over the course of 14 months from July 2021 to September last year, Kurtaj also contacted broadband provider BT, mobile operator EE and software company Nvidia, as well as Uber, demanding multi-million dollars. Kurtaj was 16 and 17 years old at the time. Kurtaj, who has autism spectrum disorder, was diagnosed by psychiatrists as unfit to enter a plea or stand trial.
However, after two months of deliberation, a jury found that he had committed the alleged 12 crimes – six of which were unauthorised use of a computer; three of which were blackmail; two of which were fraud offences; and one of which was non-compliance with a Section 49 notice to hand over a key after he refused to give up his mobile phone password when asked to do so by police.
GTA VI Trailer: What We Learned From Our First Look at The Next Grand Theft Auto
The judge ordered him to remain in hospital for an indeterminate amount of time under section 41 of the Mental Health Act. This section has a restriction that means he can only be released from hospital if approved by the justice secretary.
Kurtaj was convicted along with a juvenile (17 years old) who cannot be named due to his age. The juvenile admitted to one charge under the CISA and one charge of fraud. Kurtaj was convicted of one charge of fraud, one charge of blackmail and one charge of committing an unauthorised action to interfere with the functioning of a computer.
The judge noted that you were “one of the key participants in what was a series of cyber attacks perpetrated by a hacking group known as Lapsus$.” The group went after big tech companies, hacking them, extorting money from them and scamming them.
According to the court documents, the young offender was part of the group from July 2021 to February Last year when he was 15 years old and engaged in conduct against EE/BT, as well as Nvidia, a breach of which resulted in EE/BT incurring nearly $4 million in remedial costs. According to the judge, the 18-year-old, who has autism, also made a “bold attempt” to hack into the CCTV system of the London police.
In addition to the fraud charges, the teen was also found guilty of stalking offences at the youth court. The court heard that the teen used the email accounts of foreign governments to send emergency requests for information to companies such as Discord, Google, Uber and others in order to obtain personal information from those he was targeting.
He was given a youth rehabilitation order with a supervision order of 18 months and a prohibited activity order of 6 months for using a VPN.
