A London jury has found two teenagers responsible for numerous high-profile hacks as members of the Lapsus$ group, which carried out various attacks on Grand Theft Auto game publisher Rockstar Games, tech giant Nvidia, ride sharing service Uber, and British telecommunications company EE, among others.
Both 18-year-old Arion Kurtaj and a 17-year-old male—who was not identified due to his age—were convicted in court Wednesday, Bloomberg reports. Kurtaj was blamed for hacking Rockstar Games’ servers in 2022 and leaking confidential information to the public about the upcoming game, Grand Theft Auto 6.
In 2022, Kurtaj illegally retrieved sensitive data and video from Grand Theft Auto 6 from the company and posted a message in Rockstar Games’ Slack group stating, “I am not a Rockstar employee, I am an attacker.”
Kurtaj told Rockstar that he had acquired all of Grand Theft Auto 6’s data and gave the firm an ultimatum, demanding that it contact him over Telegram or he would release the stolen data. Over 90 video clips and images of Grand Theft Auto 6 were then published on an online forum, and Rockstar Games confirmed the authenticity of the early footage.
The leaked content suggested that Grand Theft Auto 6 would have the franchise’s first-ever female protagonist, and be set in the Miami-inspired Vice City. The game will have a Latina woman and a white man as its two playable protagonists, Bloomberg reported. The as-yet-unrevealed game is the follow-up to 2013’s Grand Theft Auto 5, one of the most successful games of all time with over 185 million copies sold to date.
The London jury found Kurtaj at fault for all 12 charges, Reuters reported, including six charges under Britain’s Computer Misuse Act as well as three counts of blackmail and two counts of fraud.
But Kurtaj, who is an autistic person, did not appear in court due to a psychiatric evaluation that concluded he was unfit to stand for trial, the BBC reported. Therefore, the court did not announce a “guilty” verdict, but instead found him legally responsible for the crimes.
The teen duo were also accused of hacking Nvidia together, and the unnamed 17-year-old was convicted for hacking Nvidia and committing fraud and blackmail after he stole approximately 1 terabyte of data from the tech hardware giant and held it for ransom.
The 17-year-old, whom the BBC reported is also an autistic person, was found guilty of one count under the Computer Misuse Act, one count of fraud, and one count of blackmail for the Nvidia hack. He was found not guilty for one count of blackmail and another under the Computer Misuse Act, as it relates to allegations that he had hacked EE parent company BT.
The two young men worked as “key players” in the Lapsus$ group, which is believed to be an international organization of cyberattackers that, while loosely organized, possessed a deft ability to quickly hack into high-profile tech and gaming firms.
Lapsus$ members would often demand ransoms, send mass text messages with their demands, take over victims’ computers and delete data in front of them, and publish various images “to demonstrate their access,” according to a U.S. Cybersecurity and Infrastructure Security Agency (CISA) report into the group’s activity from 2021 to 2022.
While CISA called Lapsus$ “unique for its effectiveness, speed, creativity, and boldness,” it also noted that “in some cases, attacks appeared to reflect a ‘smash-and-grab’ approach that seemed to prioritize speed over strategy and sometimes missed opportunities to extract higher-value data.”
Editor's note: This story was updated after publication to clarify the headline, as just one of the two convicted teenagers was specifically tied to the Rockstar Games hack.