Member of Lapsus$ gang sentenced to an indefinite hospital order

A member of the Lapsus$ cyber extortion group, Arion Kurtaj, has been sentenced to an indefinite hospital order.

The UK Southwark Crown Court has sentenced Arion Kurtaj, a prominent member of the international cyber extortion gang Lapsus$, to an indefinite hospital order.

Over the years, the Lapsus$ gang compromised many high-profile companies such as NVIDIA, Samsung, Ubisoft, Mercado Libre, Vodafone, Microsoft, Okta, and Globant.

The gang’s attacks on tech giants including Uber, Nvidia and Rockstar Games cost the firms nearly $10m.

The motivation behind the sentence is Kurtaj’s aptitude toward criminal activity that represents a threat to society.

Arion Kurtaj (18) was convicted in August 2023 by a London jury of having hacked multiple high-profile companies. Since September 2022, Kurtaj conducted a series of solo attacks, he gained access to around 5,000 Revolut customers’ records and hacked Uber causing $3 million of damage. Then he targeted Rockstar Games and threatened to release the source code for the popular video games Grand Theft Auto sequel.

Kurtaj has autism and was assessed by psychiatrists as not fit to stand trial. However, a jury was asked to determine if the teenager was responsible for the series of attacks and if he acted with the criminal intent.

Kurtaj had previously pleaded guilty to one count under the Computer Misuse Act and one count of fraud in relation to the BT, and to one count under the Computer Misuse Act for the hack of the City of London Police.

“He will remain at a secure hospital for life unless doctors deem him no longer a danger. The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage.” reported BBC. “Doctors deemed Kurtaj unfit to stand trial due to his severe autism so the jury was asked to determine whether or not he committed the alleged acts – not if he did so with criminal intent.”

The way the youngster has breached Rockstar is incredible. Even after the police seized Kurtaj’s laptop, he breached the developer of GTA with an Amazon Firestick, his hotel TV, and a mobile phone.

Kurtaj stole 90 clips of the unreleased and highly anticipated Grand Theft Auto 6, then shared the clips and source code on a forum using the username TeaPotUberHacker.

The man will remain confined at the hospital until doctors certify that he is no longer a danger to society.

The BBC reported that another Lapsus$ member, who is 17, was found guilty in the same trial. The press did not disclose the name of the youngster because of his age,

According to the Southwark Crown Court, he took part with Lapsus$’s attacks against giant Nvidia and phone company BT/EE.

“As well as hacking offences the boy was sentenced for what the judge described as “unpleasant and frightening pattern of stalking and harassment” of two young women.” BBC added. “Kurtaj and the 17-year-old are the first members of the Lapsus$ group to be convicted but it is thought others are still at large.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Lapsus$)