An 18-year-old hacker’s journey from international cybercrime to an indefinite hospital order. In a case that has sent shockwaves through the tech industry, Arion Kurtaj, an 18-year-old from Oxford, has been sentenced to an indefinite hospital order after leaking clips of the highly anticipated Grand Theft Auto 6 (GTA 6) game. Kurtaj, who is autistic, was a prominent member of the notorious international hacking group Lapsus$.
The Lapsus$ gang gained notoriety for its audacious cyber attacks on tech giants, including Uber, Nvidia, and Rockstar Games, causing these companies nearly $10 million in damages. Arion Kurtaj played a key role in orchestrating these attacks, showcasing a level of cyber expertise that garnered attention.
During the sentencing, the judge emphasized Kurtaj’s exceptional skills in cybercrime and expressed concern about the risk he posed to the public. Due to his severe autism, doctors had previously deemed him unfit to stand trial. Consequently, the jury’s role was not to determine criminal intent but to establish whether Kurtaj had committed the alleged acts.
The court learned that Kurtaj exhibited violent behavior while in custody, with numerous reports of injuries and property damage. A mental health assessment revealed that he continued to express a strong desire to return to cybercrime, indicating a high level of motivation.
One of the most astonishing aspects of Kurtaj’s exploits was his ability to hack into Rockstar Games, the company behind the Grand Theft Auto series, even while on bail. Despite having his laptop confiscated, he ingeniously used an Amazon Firestick, his hotel TV, and a mobile phone to breach the company’s internal Slack messaging system.
Once inside, Kurtaj boldly declared his intentions, threatening to release the source code for GTA 6 if Rockstar Games did not contact him on Telegram within 24 hours. Following through on his promise, he posted stolen clips and the source code on a forum under the username TeaPotUberHacker, leading to his rearrest and subsequent detention until the trial.
The sentencing’s final decision, an indefinite hospital order, means that Arion Kurtaj will be confined to a secure hospital for life unless medical professionals determine that he no longer poses a danger to society. This case sheds light on the intersection of cybercrime, mental health, and the challenges of dealing with exceptionally skilled individuals who may pose a risk to public safety.
