A teenage member of the Lapsus$ hacking group has been sentenced to indefinite detention in hospital for hacking Uber and fintech firm Revolut, and for blackmailing the developers of best-selling video game Grand Theft Auto.
Key points:
- Arion Kurtaj, 18, embarked on a solo cybercrime spree in September 2022
- He targeted Revolut, Uber and Grand Theft Auto developer Rockstar Games
- Kurtaj was assessed as not fit to stand trial and was sentenced based on whether he had committed the acts
Arion Kurtaj, 18, embarked on a solo cybercrime spree in September 2022 while on police bail for earlier offences.
He targeted Revolut, accessing around 5,000 Revolut customers’ information, and then Uber two days later, causing nearly $US3 million ($4.4 million) of damage to the ride-sharing company, prosecutors said.
Kurtaj then hacked Rockstar Games and threatened to release the source code for the company’s planned Grand Theft Auto sequel in a Slack message to all Rockstar staff.
Jurors at London’s Southwark Crown Court were played clips of the latest upcoming instalment of Grand Theft Auto, which Kurtaj had hacked and uploaded to an online gaming forum.
Kurtaj, who has autism, was assessed by psychiatrists as not fit to stand trial, so the jury was asked to find whether he had committed the acts rather than deliver a verdict of guilty.
He had previously hacked and blackmailed Britain’s biggest broadband provider BT Group and mobile operator EE in 2021, demanding a $US4 million ransom.
Kurtaj also hacked chipmaker Nvidia in February 2022, taking around one terabyte of data, releasing about 80 gigabytes and threatening to publish the rest.
‘Key players’
Kurtaj and a 17-year-old, who cannot be named for legal reasons and whose case was heard alongside Kurtaj’s, were “key players” in Lapsus$, prosecutors said.
A jury in August found Kurtaj committed 12 offences, including three counts of blackmail, two counts of fraud and six charges under the Computer Misuse Act.
The 17-year-old was found guilty in August of one count of fraud, one count of blackmail and one count under the Computer Misuse Act relating to Nvidia.
He previously pleaded guilty to one count under the Computer Misuse Act and one count of fraud in relation to the BT hack. He had also admitted an offence relating to the hacking of the City of London Police’s cloud storage, weeks after his 2022 arrest.
Judge Patricia Lees said on Thursday that Kurtaj remained “determined to commit further serious offences if the opportunity arose” and sentenced him to indefinite detention.
The 17-year-old was sentenced to a youth rehabilitation order with 18 months supervision.
Detective Chief Superintendent Amanda Horsburgh, from City of London Police, said the case “serves as an example of the dangers that young people can be drawn towards whilst online”.
Reuters