GTA Hacker Gets Life Sentence for Stealing $10 Million Data

Arion Kurtaj’s joyride as a Grand Theft Auto (GTA) criminal appears to have crashed and burned.

The 18-year-old hacker from Oxfordshire, UK, played a crucial role in the Lapsus$ group — an international cybercrime syndicate that inflicted nearly $10 million in damages to several high-profile tech companies, including Uber, Nvidia, and Rockstar Games (the company that makes GTA), according to the BBC.

Kurtaj’s most infamous crime was breaching Rockstar while in police custody and releasing 90 clips of unreleased Grand Theft Auto 6 footage.

Despite being on bail for hacking Nvidia and having his laptop confiscated, Kurtaj still managed to break into Rockstar’s servers from a Travelodge motel, using an Amazon Firestick, the hotel TV, and a mobile phone.

He then broke into the company’s internal Slack with a warning, “If Rockstar does not contact me on Telegram within 24 hours, I will start releasing the source code.”

Related: Cyber Attacks Are On the Rise — Here’s How Your Business Can Continuously Prepare for Threats

Autism cited

Kurtaj has severe autism and was reportedly quite violent in custody, injuring people and damaging property. The severity of his disorder led to the court’s decision to confine him to a secure medical facility indefinitely.

According to a mental health assessment, he “continued to express the intent to return to cyber-crime as soon as possible. He is highly motivated.”

In contrast, a 17-year-old Lapsus$ member, whose identity remains protected, was issued an 18-month Youth Rehabilitation Order. Both youths stand as the first convicted members of the Lapsus$ gang. Other suspects remain at large.

Kurtaj’s defense team argued that the success of the recently released GTA 6 trailer, with over 128 million views in just four days, signaled minimal harm to Rockstar Games.

But Judge Patricia Lees said extensive damage was done to the actual victims of the group’s numerous cyber attacks. In addition to Rockstar Games having to pay Lapsus$ $5 million to recover its data, other hacks by Lapsus$ involved threatening communications sent to thousands of cell phone customers and stealing money from cryptocurrency wallets.

“This case serves as an example of the dangers that young people can be drawn towards whilst online and the serious consequences it can have for someone’s broader future,” said Detective Chief Superintendent Amanda Horsburgh from the City of London Police.

Related: Comcast Xfinity Hackers Stole Personal Information From More Than 35 Million Customers, the Company Says