A British teenager who hacked into the network of Rockstar Games and leaked unreleased footage of the highly anticipated Grand Theft Auto 6 has been sentenced to life in a secure hospital. Arion Kurtaj, 18, from Oxford, was found guilty of 12 charges of hacking, blackmail, fraud, and theft in August, but his sentencing was delayed until today.
Kurtaj was part of a hacking group called Lapsus$, which also targeted other major companies such as Nvidia and Uber. He was arrested in September 2022 after his identity and location were exposed by rival hackers. He was placed in a hotel by the police for his own safety, but he continued to hack from his room, using an Amazon Fire Stick, a smartphone, a keyboard, and a mouse.
His most audacious hack was infiltrating Rockstar’s messaging service Slack and posting: “I am not a Rockstar employee, I am an attacker.” He then leaked about 100 videos of GTA 6, which is expected to be released in 2024. The leak caused significant damage to the company, as GTA 6 is a billion-dollar franchise and one of the most popular video games in the world.
Kurtaj did not stand trial because he was deemed unfit to do so by psychiatrists. He was diagnosed with autism spectrum disorder, obsessive compulsive disorder, and psychosis. He also had a history of violence and self-harm while in custody. Dr Claudia Camden-Smith, who assessed Kurtaj, said that he was “highly motivated to return to offending” and that he had “no insight into the impact of his actions on others”.
A Life Sentence with Restrictions
Judge Patricia Lee sentenced Kurtaj to life in a secure hospital under the Mental Health Act. She said that he was suffering from a mental illness that required treatment and that he posed a serious risk to the public. She also said that he had shown no remorse or empathy for his victims, who had their data stolen, their accounts drained, and their lives turned upside down.
The judge said that Kurtaj’s sentence was not a punishment, but a way to protect him and others from harm. She said that he would only be released if he was no longer considered dangerous and that he would be subject to strict restrictions and supervision. She also ordered him to pay £1.3 million in compensation to Rockstar Games and £200,000 to Nvidia.
Kurtaj appeared via video link from Feltham prison and showed no emotion during the hearing. His lawyer, James Reilly, said that he had a “very troubled background” and that he had been “exploited by others” in the hacking group. He also said that Kurtaj had a “keen interest in fishing” and that he hoped to pursue it as a hobby in the future.
A Warning to Other Hackers
The case of Kurtaj is one of the most serious examples of cybercrime in the UK. It shows the extent of the damage that hackers can cause to businesses and individuals, as well as the potential consequences for the hackers themselves. The police and the prosecutors have warned that hacking is not a game, but a serious offence that can result in a long prison sentence or a life in a secure hospital.
Detective Sergeant Gary Hooks, from the National Crime Agency, said that Kurtaj was a “digital bandit” who thought he was untouchable. He said that the NCA had worked closely with the City of London Police, the FBI, and the companies affected by the hacks to bring him to justice. He also said that the NCA would continue to pursue and prosecute hackers who target UK businesses and citizens.
Kevin Barry, the prosecutor, said that Kurtaj’s crimes were not victimless, but quite the opposite. He said that Kurtaj had caused “enormous harm” to the companies he hacked and to their customers, who had their personal and financial information compromised. He also said that Kurtaj had “undermined the trust and confidence” of the public in the online world.
