Teenage Grand Theft Auto 6 hacker given an indefinite sentence in a secure hospital due to his 'intent to return to cybercrime as soon as possible'

Grand Theft Auto 6 trailer art
(Image credit: Rockstar Games)

A BBC report says that the 18-year-old hacker who was found responsible for committing a series of attacks on tech firms that included the theft and leak of Grand Theft Auto 6 footage in 2022 has been sentenced to an indefinite period in a secure hospital.

Arion Kurtaj was found responsible for the attacks on Rockstar, Nvidia, and other tech firms as part of the Lapsus$ group in August. Following an assessment by a psychiatrist, however, the judge in the case determined that Kurtaj was unfit to stand trial, and so the jury was asked only to determine if he had actually committed the hacks, but not whether it was done with criminal intent.

Kurtaj's mental health assessment determined he has "acute autism" and said he's "highly motivated" and "continued to express the intent to return to cybercrime as soon as possible." Kurtaj carried out his Rockstar hack while he was on bail and in police custody at a Travelodge hotel for previous hacks, using just an Amazon Fire Stick, the hotel television, and a mobile phone.

The judge in the case said Kurtaj's skills and determination to do crime make him a high risk to the public, and so he will remain in a secure hospital for life, unless and until doctors determine that he's no longer a danger.

"Danger" might seem like a strong term for a guy who leaked some videogame footage, but while the GTA 6 hack was Kurtaj's highest-profile crime from a gamer perspective, it was far from his only one. The Lapsus$ group also hacked Microsoft, Samsung, Nvidia and UK telecom company BT&EE, and stole millions in cryptocurrency from individuals. Kurtaj was also reportedly violent while in custody, causing "dozens" of reports of injuries and property damage. 

A 17-year-old juvenile member of Lapsus$ who had worked with Kurtaj and others on some hacks was found guilty in the same trial. Along with the hacks, the teen was also sentenced for stalking and harassing two young women: Because he's a minor (which is also why he can't be named), the 17-year-old was given an 18-month Youth Rehabilitation Order, a community sentence for offenses that fall short of requiring imprisonment.

Kurtaj and the 17-year-old are the first members of Lapsus$ to be convicted, but likely won't be the last: Seven teenagers connected to Lapsus$ were arrested in the UK in 2022, and the BBC report says more members are thought to remain at large.

Andy Chalk

Andy has been gaming on PCs from the very beginning, starting as a youngster with text adventures and primitive action games on a cassette-based TRS80. From there he graduated to the glory days of Sierra Online adventures and Microprose sims, ran a local BBS, learned how to build PCs, and developed a longstanding love of RPGs, immersive sims, and shooters. He began writing videogame news in 2007 for The Escapist and somehow managed to avoid getting fired until 2014, when he joined the storied ranks of PC Gamer. He covers all aspects of the industry, from new game announcements and patch notes to legal disputes, Twitch beefs, esports, and Henry Cavill. Lots of Henry Cavill.