A teenager behind the notorious hack which saw footage of the unreleased Grand Theft Auto VI game leaked online has been detained indefinitely under the Mental Health Act.
Arion Kurtaj, 18, a “key player” in the Lapsus$ group, carried out a hacking spree against major tech firms including Rockstar Games, the developer of the hugely successful video game franchise.
He stole codes and footage of the unreleased Grand Theft Auto VI, the long-awaited sequel which is due to hit the shelves next year more than a decade after the last installment.
Kurtaj published some of the stolen footage on online forums and blackmailed developer Rockstar, threatening to release the source code unless they contacted him in September last year.
Judge Patricia Lees said the “hacking resulted in a huge loss of marketing opportunities for Rockstar which was unquantifiable” and cost the firm $1.5m (around £1.2m) in external help alone, along with thousands of hours of work by employees.
Kurtaj also targeted broadband provider BT and mobile operator EE, software company Nvidia and Uber – making multi-million dollar demands – over a 14-month period between July 2021 and September last year while he was aged 16 and 17.
Psychiatrists had assessed Kurtaj, who is autistic, as unfit to enter pleas to charges or stand trial.
But a jury found he had carried out the acts alleged against him, which amounted to 12 offenses – including six counts of carrying out an unauthorized act to impair the operation of a computer, three counts of blackmail, two fraud offenses, and of failing to comply with a section 49 notice to disclose a key when he did not give up the password to his mobile phone when asked to by police – following a two-month case.
The pair were sentenced at Guildford Crown Court. File Pic
Read more:
GTA VI trailer: What we learned from first look at next Grand Theft Auto
The judge ordered that he should be detained in hospital for an indefinite period of time under the Mental Health Act, with a restriction under Section 41, meaning he can only be discharged from hospital if the justice secretary approves it.
Kurtaj was sentenced alongside a 17-year-old boy, who cannot be named because of his age, who pleaded guilty to one offense under the Computer Misuse Act and one count of fraud, and was found guilty of one count of fraud, a charge of blackmail and having carried out an unauthorized act to impair the operation of a computer.
“You two were key players in what was a spree of cyber offending by a hacking group calling itself Lapsus$,” the judge said.
“That group targeted large technology companies and subjected them to hacking, blackmail and fraud.”
The court heard the youth was a member of the group between July 2021 and February last year when he was aged 15 and involved in offenses against EE/BT and Nvidia – a hack which cost the company $5m (almost $4m) in remedial costs.
The judge said the youngster, who has been diagnosed with autism, also carried out an “audacious hack” into the City of London police system to view CCTV footage.
The teenager was also convicted of fraud and stalking offenses in the youth court after using the email addresses of international government officials to send emergency disclosure requests to companies including Discord, Google and Uber to obtain personal details of those he targeted, the court heard.
He was handed a youth rehabilitation order, including an 18-month supervision requirement and a six-month prohibited activity requirement to stop him using a VPN.