Arion Kurtaj, an 18-year-old hacker from Oxford, has been sentenced to an indefinite period of time in a secure hospital after a serious security breach involving unpublished footage of the highly anticipated Grand Theft Auto 6 (GTA 6) video game, which may launch in September 2025. Kurtaj, who has been diagnosed with acute autism, was a prominent member of the international hacker group Lapsus$, known for its attacks on such well-known technology companies as Nvidia, Microsoft, Uber and Rockstar Games, causing around $10 million in damage.
Despite being out on bail for a previous Nvidia hack and under police protection at a Travelodge hotel, Kurtaj carried out a significant hack of Rockstar Games. Using an Amazon Firestick, a hotel TV, and a cell phone, he hacked into Rockstar’s internal Slack messaging system and posted 90 GTA 6 clips, which he threatened to release further if Rockstar did not contact him. The leak included the game’s source code and videos posted under the pseudonym “TeaPotUberHacker.”
Kurtadzhe’s trial was unique because his autism meant that he was deemed unfit to stand trial in the traditional sense. Instead, the jury was tasked with determining whether he was responsible for the attacks, rather than assessing his criminal intent. His aggressive behavior during his incarceration and his constant expression of intent to return to cybercrime were important factors in the trial.
The impact of Kurtaj’s actions was profound: Rockstar Games reported losses of $5 million and thousands of hours of work time spent on recovery. Despite this, Kurtaj’s defense argued that the recent successful release of the GTA 6 trailer showed minimal negative impact of the hack. However, the court recognized the broader harm caused by his and Lapsus$ activities, including attacks on other major tech firms and individuals.
Another 17-year-old Lapsus$ member was also found guilty in the same trial and ordered to undergo juvenile rehabilitation. Lapsus$, referred to as “digital gangsters,” are known for their brazen cybercrime, often publicly mocking their victims. While Kurtaj and an unnamed minor were convicted, other members of the group are believed to still be at large. The case highlights growing concerns about sophisticated cybercrime being committed by increasingly younger individuals.