
A gifted yet vulnerable autistic teenager from Oxford has been handed an indefinite hospital order after admitting to a string of high-profile cyberattacks that shook some of the world's largest corporations.
Arion Kurtaj, 18, a key member of the international cybercrime gang Lapsus$, was deemed by psychiatrists to still pose a significant risk to the public. His sophisticated hacking spree targeted gaming giant Rockstar Games—creators of the wildly popular Grand Theft Auto series—ride-hailing app Uber, and telecoms provider EE.
The Scale of the Cyber Onslaught
Despite being under police protection in a Travelodge hotel after a previous arrest, Kurtaj managed to continue his illegal activities. Using an Amazon Firestick, his hotel television, and a mobile phone, he breached Rockstar's security systems.
His most brazen act was the theft of 90 clips of unreleased footage from the upcoming Grand Theft Auto 6. He then dumped this priceless data online and threatened to release the game's source code unless his demands were met.
Targeting Corporate Giants
But Rockstar wasn't his only victim. The cyber prodigy also:
- Hacked Uber: He compromised the company's internal systems, gaining access to sensitive corporate data and causing widespread alarm.
- Attacked EE: He accessed the telecom giant's data, putting the personal information of millions of customers at potential risk.
Southwark Crown Court heard that Kurtaj's skills were off the scale, but his severe autism meant he lacked any sense of the real-world consequences of his actions.
A Sentence for Treatment, Not Punishment
Mr. Justice Bryan sentenced Kurtaj to life in a secure hospital, stating the teen would only be released once doctors deem him no longer a danger. A second 17-year-old member of Lapsus$, who cannot be named, was given a Youth Rehabilitation Order for his role in the attacks.
This case highlights the complex intersection of extreme talent, neurodiversity, and the severe vulnerabilities in corporate cybersecurity that young hackers can so easily exploit.