Arion Kurtaj, an 18-year-old hacker from Oxford, has been sentenced to an indefinite hospital order following his involvement in leaking footage of the highly anticipated Grand Theft Auto (GTA) VI game.
Kurtaj, diagnosed with severe autism, was a prominent figure in the international cybercrime group Lapsus$. His actions, which included attacks on several technology companies such as Uber, Nvidia and Rockstar Games, led to nearly $10 million in damages.
The sentencing judge emphasized that Kurtaj's advanced skills and inclination towards cybercrime continue to pose a significant threat to the public. As a result, he will remain in a secure hospital indefinitely, subject to the discretion of medical professionals regarding his potential danger in the future.
During his time in custody, Kurtaj was reported to have been violent, with multiple incidents of injury and property damage. He was deemed unfit to stand trial due to his severe autism, leading the jury to focus solely on whether he committed the acts, rather than assessing criminal intent.
Kurtaj's notoriety peaked with his breach of Rockstar Games' internal systems, where he obtained and leaked 90 clips of the unreleased GTA VI.
Even while on bail for previous hacking offenses and under police protection, Kurtaj managed to continue his cybercriminal activities, using an Amazon Firestick, a hotel TV and a mobile phone to execute the GTA hack.
Despite the defense team's argument that the successful release of the GTA VI trailer, which amassed 156 million views on YouTube to date, indicated minimal harm to Rockstar Games, the judge highlighted the real victims and significant damage caused by Kurtaj’s extensive cybercrime.
Alongside Kurtaj, another 17-year-old Lapsus$ member was found guilty in the same six-week trial at Southwark Crown Court. The minor, who wasn't named for legal reasons, was sentenced to an 18-month Youth Rehabilitation Order, including intense supervision and a ban on using VPNs online.
This sentence also covered charges of stalking and harassment against two young women.
Lapsus$, described in court as "digital bandits," gained notoriety for their audacious attacks on multinational corporations and their public taunting of victims.