An 18-year-old hacker from Oxford, Arion Kurtaj, who leaked clips from the highly anticipated Grand Theft Auto 6, has been sentenced to an indefinite hospital order. Kurtaj, an autistic individual, was a key member of the international cybercrime group Lapsus$, responsible for attacks on multiple major technology companies including Uber, Nvidia, and Rockstar Games, resulting in nearly $10 million in damages.

Due to the severity of his autism, doctors deemed Kurtaj unfit to stand trial in the conventional sense, so the jury was tasked only with determining whether he committed the alleged actions. In their assessment, medical professionals highlighted Kurtaj’s continued intention to resume cybercrime, emphasizing that he posed a significant public risk due to his skill level and motivation. As a result, Kurtaj will remain in a secure hospital indefinitely, pending any future assessment that might deem him no longer a danger.

During the trial, it emerged that while on bail and under police protection in a Travelodge hotel, Kurtaj continued hacking using an Amazon Firestick, his hotel TV, and a mobile phone, despite his laptop being confiscated. His most notorious hack involved breaching Rockstar Games and stealing 90 clips of GTA 6, which he later posted online under the alias “TeaPotUberHacker.” He also infiltrated Rockstar’s internal Slack system, threatening to release the game’s source code unless contacted within 24 hours via Telegram. He was soon rearrested and held until the trial.

Recently, Rockstar released the official GTA 6 trailer, which garnered 128 million views on YouTube within four days, prompting Kurtaj’s defense team to argue that the game’s success minimized any potential harm caused by the leak. However, Judge Lees highlighted the real harm experienced by companies and individuals affected by the Lapsus$ group’s activities, noting Rockstar Games alone incurred $5 million in recovery costs and significant hours of employee time.

A second Lapsus$ member, a 17-year-old who collaborated with Kurtaj, was also found guilty in the trial. The minor was sentenced to an 18-month Youth Rehabilitation Order with strict supervision and a ban on using VPNs. His charges extended beyond hacking to include a disturbing pattern of stalking and harassment against two young women. Both individuals are the first members of Lapsus$ to face conviction, though authorities believe additional members remain unidentified.

Lapsus$ became infamous for its brazen tactics in 2021 and 2022, targeting multinational corporations such as Microsoft and Revolut. The group, primarily composed of teenagers from the UK and Brazil, used a blend of hacking and deceptive techniques to infiltrate secure systems, taunting victims on social media and celebrating their exploits publicly. Their activities prompted a U.S. cyber-authority report, underscoring the ease with which juvenile members accessed well-defended organizations. Although Lapsus$’s financial gains remain uncertain, the group’s disruptive impact on the cybersecurity landscape is undeniable.