An 18-year-old autistic hacker from Oxford, Arion Kurtaj, has been sentenced to an indefinite hospital order for his role in cyber-attacks on major companies including Uber, Nvidia, and Rockstar Games. The attacks, carried out as part of the international gang Lapsus$, cost the firms nearly $10 million.
Kurtaj, deemed unfit to stand trial due to severe autism, was found to have committed the acts without criminal intent. However, the judge ruled that his skills and desire to commit cyber-crime made him a high risk to the public. He will remain in a secure hospital unless doctors deem him no longer dangerous.
While on bail for previous hacks, Kurtaj used an Amazon Firestick, hotel TV, and mobile phone to breach Rockstar Games, stealing 90 clips of the unreleased Grand Theft Auto 6. He posted the clips and source code online, causing $5 million in damages to the game developer alone.
A 17-year-old accomplice, who cannot be named, was sentenced to an 18-month Youth Rehabilitation Order for his role in the attacks and for stalking and harassment. The pair are the first Lapsus$ members convicted, but others remain at large.
