Teenage Grand Theft Auto 6 hacker given an indefinite sentence in a secure hospital due to his 'intent to return to cybercrime as soon as possible.'

In a recent ruling, an 18-year-old involved in a string of high-profile cyber attacks has been hospitalized indefinitely following a series of tech breaches, including the notorious leak of in-development footage from the eagerly anticipated video game Grand Theft Auto 6 in 2022.

The hacker, Arion Kurtaj, was identified as being associated with the cybercriminal group Lapsus$, which targeted companies such as Rockstar and Nvidia, among others, last August. A court found that Kurtaj's mental state, diagnosed as "acute autism," rendered him unfit for a traditional trial. Therefore, the jury only assessed the facts surrounding his actions without delving into the intent behind the criminal activities.

Kurtaj had demonstrated his capabilities and intent to engage in further cybercrime, which he did while he was on bail and lodged at a Travelodge hotel. Using minimal equipment – an Amazon Fire Stick, the hotel's television, and a mobile phone – he carried out his attack on Rockstar Games.

A judge remarked on Kurtaj’s high competency in cybercrime, coupled with his drive for criminal activity, making him a public safety threat. Consequently, Kurtaj is expected to remain under specialized care in a secure medical institution indefinitely. This arrangement may only change if medical professionals agree that he poses no risk in the future.

While the Grand Theft Auto 6 leak was a notable incident, it represented just a fraction of Kurtaj's activities. The group he was part of, Lapsus$, infiltrated networks of multiple tech giants, including Microsoft, Samsung, Nvidia, and British telecommunications giant BT&EE, while also amassing millions through cryptocurrency thefts. His behavior in custody was reported to be aggressive, with multiple incidents causing injury and property damage.

At the same trial, a 17-year-old involved in hacks with Kurtaj and other peers was convicted. The juvenile, whose identity is withheld due to age, received an 18-month Youth Rehabilitation Order after being found guilty of engaging in hacks as well as stalking and harassing two young females.

Kurtaj and his juvenile co-defendant represent the first members of the Lapsus$ group to face conviction. It is noteworthy that in 2022, seven teens were arrested in the UK in connection to Lapsus$, and there is an indication that other members are still at large. As the investigation proceeds, it is anticipated that more individuals linked to these cybersecurity threats will be identified and held accountable.