Cybercrime This article is more than 1 month old

British teenager behind GTA 6 hack receives indefinite hospital order

This article is more than 1 month old

Arion Kurtaj, who has severe autism, hacked Rockstar Games using just an Amazon Firestick, mobile phone and hotel TV

A teenager who stole 90 clips of the unreleased Grand Theft Auto 6 game as part of a hacking spree has been sentenced to an indefinite hospital order.

Arion Kurtaj, 18, who is autistic, was on bail for hacking the software firm Nvidia and BT/EE and also in police protection at a Travelodge hotel when he continued his hacking and breached Rockstar Games, the company behind GTA, a court heard.

Despite having his laptop confiscated, Kurtaj, carried out his cyber attack using an Amazon Firestick, his hotel television and a mobile phone. He broke into the company’s internal Slack messaging system to declare: “If Rockstar does not contact me on Telegram within 24 hours I will start releasing the source code.”

Kurtaj, from Oxford and part of the Lapsus$ hacking group, posted the clips and source code on a forum. He will remain at a secure hospital for life unless doctors deem him no longer a danger, Southwark crown court heard on Thursday.

The case has prompted City of London police to advise parents to be aware of their children’s internet usage.

The court heard that Kurtaj had been violent while in custody, with dozens of reports of injury or property damage. Doctors deemed him unfit to stand trial due to his severe autism and the jury was asked to determine whether or not he committed the alleged acts, not if he did so with criminal intent.

A mental health assessment used as part of the sentencing hearing said he “continued to express the intent to return to cyber-crime as soon as possible”, adding: “He is highly motivated.”

Kurtaj hacked in to Rockstar Games and stole 90 clips of GTA 6 before the game had been released. Photograph: Rockstar Games/AFP/Getty

Another Lapsus$ member, who is 17 and cannot be named for legal reasons, was found guilty in the same trial of two counts of fraud, two Computer Misuse Act offences and one count of blackmail.

He was sentenced to a youth rehabilitation order at Guildford crown court in Surrey on Thursday.

As part of the order, he will have an 18-month supervision requirement, a six-month rehabilitation requirement and a three month intensive supervision and surveillance requirement.

DCS Amanda Horsburgh, from the City of London police, said: “This case serves as an example of the dangers that young people can be drawn towards whilst online and the serious consequences it can have for someone’s broader future.

“Many young people wish to explore how technology works and what vulnerabilities exist. This can include learning to code, interacting with like-minded individuals online and experimenting with tools.

“Unfortunately, the digital world can also be tempting to young people for the wrong reasons.”

The gang’s cyber attacks between August 2020 and September 2022 affected a telecoms company, a computer parts manufacturer, gaming companies and others.

Rockstar Games told the court that the hack cost it $5m to recover from in addition to thousands of hours of staff time.

ncG1vNJzZmivp6x7tbTEoKyaqpSerq96wqikaK2bYrumw9JoaWlqY2Sxpq%2BOa2homqKewaq%2Fx2arnp2elrSmvoybnKGhnpl6qMDAZm1moJGYuG6%2BxJycoq6VqHqqusOenaKmmamybrTOrKeirJGherC%2Bw56p