GTA 6 Hacker Receives Indefinite Hospital Order as Lapsus$ Cybercriminal Faces Sentencing

In a landmark case, an 18-year-old hacker linked to the notorious international group Lapsus$ has been handed an indefinite hospital order after leaking clips from the highly anticipated Grand Theft Auto 6 (GTA 6). Arion Kurtaj from Oxford, diagnosed with autism, played a pivotal role in Lapsus$’s cyberattacks on major tech entities like Uber, Nvidia, and Rockstar Games, resulting in losses nearing $10 million for the targeted companies.

The sentencing, announced after Kurtaj’s trial, deemed him a high risk to the public due to his cyber skills and persistent inclination toward committing cybercrimes. The indefinite hospital order implies that he will remain in a secure hospital for life unless medical professionals determine he is no longer a threat.

The court proceedings revealed instances of violence by Kurtaj while in custody, leading to dozens of reports of injury or property damage. Doctors, considering his severe autism, deemed him unfit to stand trial, prompting the jury to assess whether he committed the alleged acts rather than determining criminal intent.

Despite facing charges related to multiple hacks, including those on Nvidia, BT/EE, and Rockstar Games, Kurtaj managed to breach Rockstar while on bail, stealing 90 clips of the unreleased GTA 6. He posted the stolen content and source code on a forum, demanding contact from Rockstar within 24 hours, leading to his rearrest and subsequent trial.

Rockstar Games, the company behind GTA, reported that the hack cost them $5 million for recovery efforts and consumed thousands of hours of staff time. The defense argued that the success of GTA 6’s trailer, released earlier this month, indicated minimal harm caused by Kurtaj’s actions, but the judge emphasized the real victims and harm stemming from his other cyberattacks.

In a related development, another Lapsus$ member, a 17-year-old, was found guilty in the same trial. This teenager, who cannot be named due to age restrictions, collaborated with Kurtaj in hacking tech giants Nvidia and BT/EE, attempting a four-million-dollar ransom. He also engaged in stalking and harassment, earning him an 18-month Youth Rehabilitation Order with strict supervision and an online VPN ban.

Kurtaj and the 17-year-old are the first members of Lapsus$ to be convicted, but authorities suspect that other members of the group, described as “digital bandits,” are still at large. Lapsus$ gained infamy in the cybersecurity world for audacious attacks on major corporations, prompting US cyber-authorities to issue a comprehensive report on the group’s activities and tactics.