GTA 6 lead hacker faces life imprisonment in 'secure hospital'

Arion Kurtaj, the 18-year-old hacker responsible for the infamous Grand Theft Auto6 leak last year, was sentenced to indefinite detention in a 'secure hospital' according to the BBC. Kurtaj was deemed unfit to stand trial due to what the BBC called 'acute autism', and will spend the rest of his life in hospital unless doctors find he is 'no longer a danger'. He was found guilty of twelve charges, including fraud and blackmail.

Kurtaj is believed to be a member of an international hacking group called Lapsus$, which has claimed responsibility for hacks at Uber, Nvidia and Rockstar Games. All told, the companies said the damage caused by the hack cost them “almost $10 million,” according to the BBC. Rockstar Games said it spent $5 million recovering from the hack, plus thousands of hours from its staff.

Rockstar Games did not respond to Polygon's request for comment.

Kurtaj was reportedly out on bail after hacking Nvidia when he stumbled into Rockstar Games' Slack channel “using an Amazon Firestick, his hotel TV and a mobile phone,” the BBC reported. He was able to download and later share more than 90 video clips of the game in development. Nearly an hour of footage was published on a Grand Theft Auto forum. The footage confirmed a Bloomberg report that stated the game would be set in fictionalized Miami, better known as Vice City in the franchise, and would feature a playable female character. GTA6's first trailer revealed that this character is named Lucia, and paired with another protagonist named Jason. (The GTA6 trailer was also leaked early.)

Even with the leak, Rockstar received more than 90 million views within 24 hours of the trailer's release. Two weeks after its debut, the trailer has been viewed 155 million times. Kurtaj's lawyers argued that the success of the GTA6 The trailer showed that the hack did not cause major damage to Rockstar Games, but the judge disagreed, noting that Kurtaj also caused damage to several other people and companies – and had expressed a desire to continue hacking. Similarly, Kurtaj was said to have been violent while in custody, the BBC said, with “dozens of reports of injury or property damage” to his name since the arrest.

A 17-year-old Lapsus$ member was also convicted; he will be held for 18 months under a 'youth rehabilitation order', which, according to the BBC, requires 'intense supervision and a ban on the online use of VPNs', due to the hack and what the judge called an 'unpleasant and frightening pattern of stalking and stalking' . harassment” of two women.

The US Cybersecurity and Infrastructure Security Agency released a report on Lapsus$ in July 2023, analyzing the group's activities from 2021 to 2022. “Lapsus$ almost immediately captured the attention of cybersecurity professionals and the press after providing unprecedented transparency into the inner workings of how it targeted organizations and individuals, orchestrated its attacks, and interacted within itself and with other threat groups.” CISA wrote in the report. “The organization's mentality was visible to the world and Lapsus$ made clear how easy it was for its members (in some cases young people) to infiltrate well-defended organizations.” According to CISA, the group probably consists largely of teenagers; the two members convicted on Thursday are the only two arrested.

News from the GTA6 The conviction of hackers comes days after Sony Interactive Entertainment studio Insomniac Games released a huge amount of data following a hack by ransomware group Rhysida. In-development gameplay footage of Wolverinean anticipated upcoming game, was released alongside extensive personal data of employees and contractors.