Lapsus$: 18-Year-Old GTA 6 Hacker Sentenced to Life in Hospital Prison

18-year-old Arion Kurtaj was sentenced to life inside a hospital prison after leaking Grand Theft Auto VI footage. A British judge ruled on Thursday that Kurtaj is a high risk to the public because he still wants to commit cybercrimes.

Arion Kurtaj from Oxford was a key member of the international gang Lapsus$. The gang’s attacks on tech giants, including Uber, Nvidia and Rockstar Games, cost the firms nearly $10m.

The judge said Kurtaj’s skills and desire to commit cybercrime meant he remained a high risk to the public.

In August, a London jury found Kurtaj carried out cyberattacks against GTA VI developer Rockstar Games and other companies, including Uber and Nvidia. Kurtaj has autism and was deemed unfit to stand trial.

The jury was asked to determine whether he committed the acts in question, not whether he did so with criminal intent.

During Thursday’s hearing, the court heard Kurtaj “had been violent while in custody with dozens of reports of injury or property damage,” the BBC reports.

A mental health assessment also found that Kurtaj “continued to express the intent to return to cybercrime as soon as possible.” He’s required to stay in the hospital prison for life unless doctors determine that he’s no longer a danger.

Kurtaj leaked 90 videos of GTA VI gameplay footage last September while on bail for hacking Nvidia and British telecom provider BT / EE. 

Although he stayed at a hotel under police protection during this time, Kurtaj still managed to carry out an attack on Rockstar Games by using the room’s included Amazon Fire Stick and a “newly purchased smartphone, keyboard and mouse,” according to a separate BBC report.

He broke into the company’s internal Slack messaging system to declare,

“If Rockstar does not contact me on Telegram within 24 hours, I will start releasing the source code”.

He then posted the clips and source code on a forum under the username TeaPotUberHacker. Kurtaj was arrested for the final time following the incident.

Another 17-year-old involved with Lapsus$ was handed an 18-month community sentence, called a Youth Rehabilitation Order, and a ban from using virtual private networks.

He worked with Kurtaj and other members of Lapsus$ to hack tech giant Nvidia and phone company BT/EE and steal data before demanding a four-million-dollar ransom, which was not paid. They also stole directly from individuals through their cryptocurrency wallets.

The official trailer for GTA VI Dropper earlier this month, racking up hundreds of millions of views even after the trove of videos leaked by Kurtaj and the trailer’s premature release on X (formerly Twitter).

While Kurtaj’s defense asked the judge to take the trailer’s success into account during the sentencing, the judge argued that real companies and people were hurt by Lapsus$. Rockstar Games said it spent $5 million recovering from the attack.

Kurtaj and the 17-year-old are the first members of the Lapsus$ group to be convicted, but it is thought others are still at large.

The gang’s audacious attacks in 2021 and 2022 shocked the cyber-security world. The group from the UK, and allegedly Brazil, was described in court as “digital bandits.”