A cyber ‘genius’ teenage hacker who caused £7million of damage to the firm behind Grand Theft Auto, has been handed a hospital order and will be detained in a psychiatric facility indefinitely.
Autistic Arion Kurtaj, 18, stole code and video footage from Rockstar’s development of their latest instalment of the hit crime shooter franchise, GTA VI, as part of the multi-million-pound blackmail campaign.
Defiant tech crook Kurtaj, a key member of Lapsus$ cyber-crime group, also blackmailed telecoms firm BT/EE, demanding a $4million (£3.19million) ransom.
Along with a 17-year-old, who cannot be named, they hacked computer chip maker NVIDIA, Uber and the online bank Revolut, between July 2021 and February 2022.
A jury convicted Kurtaj, from Oxford, of 12 different offences following a seven-week trail in August. However, a sentencing hearing earlier this month heard the 18-year-old wanted to return to a life of crime after he is released.
Autistic Arion Kurtaj, 18, stole code and video footage from Rockstar’s development of their latest instalment of GTA6
He will be transferred to a secure psychiatric hospital in the new year once a bed is available at Marlborough House medium-secure hospital in Milton Keynes
Kurtaj caused £7million of damage to the firm behind Grand Theft Auto, a court heard
Consequently, Judge Patricia Lees said today the ‘only safe option’ was to detain him under section 37 of the Mental Health Act with a restriction order.
Kurtaj, who has been in custody since September last year, attended the hearing via video-link sitting at a table in a room at Feltham young offenders’ institution.
Judge Lees explained that he will be transferred to a secure psychiatric hospital in the new year once a bed is available at Marlborough House medium-secure hospital in Milton Keynes.
Wearing a black t-shirt and dark trousers he showed no emotion as he was led out of the room by a guard.
The 17-year-old, who has ASD (autism spectrum disorder) and was only 14 when the offences began, was sentenced to a youth rehabiliation order for 18 months with three months supervision.
He had been convicted by the jury of carrying out an unauthorised act relating to hacking, fraud and blackmail in relation to Nvidia.
The youth was also convicted of stalking two young women at a youth court and hacking into a City of London Police server.
Judge Lees, sitting at Guildford Crown Court today told the pair: ‘You were key players in a spree of cyber offences by a hacking group who called themselves Lapsus$
‘They targeted large tech companies who suffered great financial loss…as well as the high cost of securing their systems.’
She said the damage to Rockstar Games through the hacking of the ‘eagerly anticipated’ instalment of GTA6 was ‘unquantifiable’.
Customers of BT/EE also lost ‘trust and confidence’ in the telecommunication giant.
Kevin Barry, prosecuting, had said the hacks on Rockstar, Nvidia and Uber cost the firms around £7.4m ($9.3m) in damage alone.
Referring to the attack on Rockstar the prosecutor added: ‘This material was highly confidential as the game is a billion-dollar franchise and the latest instalment is hotly anticipated.
‘He published some of the stolen footage taken during the hack on online forums and blackmailed Rockstar Games that he would release the precious source code which forms the building blocks of the game unless they contacted him – presumably to discuss ransom payment.’
The Grand Theft Auto 6 trailer was released earlier this month with the game set to hit stores in 2025
The trailer for Grand Theft Auto 6 was released after a teaser for Rockstar Games’ open-world crime series was leaked on social media
A jury convicted Kurtaj, from Oxford, of 12 different offences following a 7 week trail in August
Mr Barry said Kurtaj was involved ‘to a deeper extent than the 17-year-old’ and has vowed to carry on hacking if he he is let out of jail.
‘Mr Kurtaj is determined to commit further offences if he gets the opportunity to do so. That determination is undimmed by spending time in custody over the last year.’
Mr Barry earlier told the court: ‘The victims in this case, and they undoubtedly were victims, were members of the public who suffered the sim swap frauds. There were also big corporations who were targeted and attacked.
‘There is no suggestion that any of these attacks were carried out by individuals out for larks and jokes.
Read Related Also: Mom falls getting off Dr. Suess merry-go-round, sues Universal Orlando for not warning her
‘It is evident that those involved were deadly serious in stealing data and profiting from that, sometimes on a truly huge scale, either by blackmail or fraud.
‘There is no suggestion that these were victimless crimes – quite the opposite is the case.
‘Customers had their data stolen and had their sims swapped and used by criminals including, the prosecution say, the defendants.
‘The consequences of that fraud were that they found their lives turned upside down, accounts ransacked and drained. Life savings taken, sometimes amounting to tens of thousands of pounds.
‘These were real-world losses suffered by individuals.
‘Of the mega-corporations involved, they described enormous disruption and loss experienced by them. The losses were very real and a direct consequence of their actions.
‘Those losses, just because they are from a big company, does not mean they are not significant. Any losses they suffer like this will ultimately be passed onto their customers, so people like us.
‘Arion Kurtaj worked as part of a team and brought various skills to the table to make the alleged attacks effective.
‘He compromised the systems of a number of companies and that has involved internal messaging services and so on. This disrupted the services for over 8,000 customers.’
On one website Kurtaj had automated the words ‘f**k me daddy’ to appear on screen. Another saw a picture of a penis appear.
Mr Barry described this as a ‘hallmark of Arion Kurtaj’.
‘GTA VI’ will be released in 2025 and will be set in the fictional Vice City, reminiscent of Miami
The trailer for GTA 6 appears to feature the first playable female character in the franchise
In one blackmail demand, Kurtaj wrote to the mobile network operator EE: ‘We are Lapsus$. Remember our name. We have your user data.
‘We have EE, BT and Orange source codes. If EE pay us four million USD before 20 August we will delete everything from our servers.’
Mr Barry added: ‘The defendants used a significant level of hacking and engineering.
‘They knew what they were doing and undertook significant attempts to cover their tracks. Considerable attempts were made to conceal their identities.
‘They engaged in a complex process, following a large number of chains of evidence. Snippets of material were found to trace the material back to the defendants.
‘On many occasions they appear to have concealed their identities skilfully and well.’
David Miller, defending Kurtaj, had described the teenager as a ‘genius’ who ‘faces spending decades in a secure environment at the taxpayers expense.
‘There must be a better way to utilise the skills he has.’
Mr Miller said it was ironic he targeted the makers of GTA, the world’s most successful ever video game where the object is to ‘rob gangs and build gangs’.
Judge Patricia Lee noted there would be companies that would be interested in employing Kurtaj if he could be rehabilitated.
‘He is not someone they could currently work with. He needs to make the choice to work hard and he could achieve that, potentially. That would be a very different future for him.’
Kurtaj, from Oxford, is autistic and a jury had found he committed a series of acts following a trial in August.
They found Kurtaj committed 12 offences; four counts of an unauthorised act to impair the operation of a computer, three counts of blackmail, two counts of fraud, one count of unauthorised modification of computer material, one count of securing unauthorised access to computer material with intent and one count of failing to comply with a Section 49 notice to disclose a key.
The 17-year-old was convicted by the jury of carrying out an unauthorised act relating to hacking, fraud and blackmail in relation to Nvidia.
He had admitted two offences under the Computer Misuse Act and one count of fraud in relation to BT.
