By Sam Tobin
LONDON (Reuters) – A teenage member of the Lapsus$ hacking group was on Thursday sentenced to indefinite detention in hospital for hacking Uber and fintech firm Revolut, and for blackmailing the developers of best-selling video game “Grand Theft Auto”.
Arion Kurtaj, 18, embarked on a solo cybercrime spree in September 2022 while on police bail for earlier offences.
He targeted Revolut, accessing around 5,000 Revolut customers’ information, and then Uber two days later, causing nearly $3 million of damage to Uber, prosecutors said.
Kurtaj then hacked Rockstar Games and threatened to release the source code for the company’s planned “Grand Theft Auto” sequel in a Slack message to all Rockstar staff.
Jurors at London’s Southwark Crown Court were played clips of the latest upcoming installment of “Grand Theft Auto”, which Kurtaj had hacked and uploaded to an online gaming forum.
Kurtaj, who has autism, was assessed by psychiatrists as not fit to stand trial, so the jury was asked to find whether he had committed the acts rather than deliver a verdict of guilty.
He had previously hacked and blackmailed Britain’s biggest broadband provider BT Group and mobile operator EE in 2021, demanding a $4 million ransom.
Kurtaj also hacked chipmaker Nvidia in February 2022, taking around one terabyte of data, releasing about 80 gigabytes and threatening to publish the rest.
‘DETERMINED’
Kurtaj and a 17-year-old, who cannot be named for legal reasons and whose case was heard alongside Kurtaj’s, were “key players” in Lapsus$, prosecutors said.
A jury in August found Kurtaj committed 12 offences, including three counts of blackmail, two counts of fraud and six charges under the Computer Misuse Act.
The 17-year-old was found guilty in August of one count of fraud, one count of blackmail and one count under the Computer Misuse Act relating to Nvidia.
He previously pleaded guilty to one count under the Computer Misuse Act and one count of fraud in relation to the BT hack. He had also admitted an offence relating to the hacking of the City of London Police’s cloud storage, weeks after his 2022 arrest.
Judge Patricia Lees said on Thursday that Kurtaj remained “determined to commit further serious offences if the opportunity arose” and sentenced him to indefinite detention.
The 17-year-old was sentenced to a youth rehabilitation order with 18 months supervision.
Detective Chief Superintendent Amanda Horsburgh, from City of London Police, said the case “serves as an example of the dangers that young people can be drawn towards whilst online”.
(Reporting by Sam Tobin; editing by Jonathan Oatis)
