GTA hacker Arion Kurtaj vows to return to crime

A teenager who hacked the gaming firm behind Grand Theft Auto, causing more than £7m worth of damage, has vowed to return to crime when he is released from jail.

Arion Kurtaj, 18, stole code and video footage from Rockstar’s development of their latest instalment of GTA6 as part of the multi-million-pound blackmail campaign.

Kurtaj, a key member of Lapsus$ group, also blackmailed telecoms firm BT/EE, demanding a $4 million ransom.

Along with a 17-year-old, who cannot be named, they hacked computer chip maker NVIDIA, Uber and the online bank Revolut, between July 2021 and February 2022.

Kurtaj, from Oxford, is autistic and a jury had to decide whether he did the acts alleged at a trial in August.

They found Kurtaj committed 12 offences; four counts of an unauthorised act to impair the operation of a computer, three counts of blackmail, two counts of fraud, one count of unauthorised modification of computer material, one count of securing unauthorised access to computer material with intent and one count of failing to comply with a Section 49 notice to disclose a key.

The 17-year-old was convicted by the jury of carrying out an unauthorised act relating to hacking, fraud and blackmail in relation to Nvidia.

He had admitted two offences under the Computer Misuse Act and one count of fraud in relation to BT.

Judge Patricia Lee is due to sentence the pair at Southwark Crown Court later but Kurtaj is expected to be detained under the Mental Health Act.

Kurtaj has been in custody since September last year and he attended the hearing via video-link from Feltham young offenders’ institution today (fri).

Kevin Barry, prosecuting, said the hacks on Rockstar, Nvidia and Uber cost the firms around £7.4m ($9.3m) in damage alone.

Referring to the attack on Rockstar the prosecutor added: ‘This material was highly confidential as the game is a billion-dollar franchise and the latest instalment is hotly anticipated.

‘He published some of the stolen footage taken during the hack on online forums and blackmailed Rockstar Games that he would release the precious source code which forms the building blocks of the game unless they contacted him – presumably to discuss ransom payment.’

Mr Barry said Kurtaj was involved ‘to a deeper extent than the 17-year-old’ and has vowed to carry on hacking if he he is let out of jail.

‘Mr Kurtaj is determined to commit further offences if he gets the opportunity to do so. That determination is undimmed by spending time in custody over the last year.’

Mr Barry earlier told the court: ‘The victims in this case, and they undoubtedly were victims, were members of the public who suffered the sim swap frauds.

‘There were also big corporations who were targeted and attacked.

‘There is no suggestion that any of these attacks were carried out by individuals out for larks and jokes.

‘It is evident that those involved were deadly serious in stealing data and profiting from that, sometimes on a truly huge scale, either by blackmail or fraud.

‘There is no suggestion that these were victimless crimes – quite the opposite is the case.

‘Customers had their data stolen and had their sims swapped and used by criminals including, the prosecution say, the defendants.

‘The consequences of that fraud were that they found their lives turned upside down, accounts ransacked and drained.

‘Life savings taken, sometimes amounting to tens of thousands of pounds.

‘These were real-world losses suffered by individuals.

‘Of the mega-corporations involved, they described enormous disruption and loss experienced by them.

‘The losses were very real and a direct consequence of their actions.

‘Those losses, just because they are from a big company, does not mean they are not significant.

‘Any losses they suffer like this will ultimately be passed onto their customers, so people like us.

‘Arion Kurtaj worked as part of a team and brought various skills to the table to make the alleged attacks effective.

‘He compromised the systems of a number of companies and that has involved internal messaging services and so on.

‘This disrupted the services for over 8,000 customers.’

On one website Kurtaj had automated the words ‘f**k me daddy’ to appear on screen. Another saw a picture of a penis appear.

Mr Barry described this as a ‘hallmark of Arion Kurtaj’.

In one blackmail demand, Kurtaj wrote to the mobile network operator EE: ‘We are Lapsus$. Remember our name. We have your user data.

‘We have EE, BT and Orange source codes. If EE pay us four million USD before 20 August we will delete everything from our servers.’

Mr Barry added: ‘The defendants used a significant level of hacking and engineering.

‘They knew what they were doing and undertook significant attempts to cover their tracks.

‘Considerable attempts were made to conceal their identities.

‘They engaged in a complex process, following a large number of chains of evidence. Snippets of material were found to trace the material back to the defendants.

‘On many occasions they appear to have concealed their identities skilfully and well.’

The 17-year-old was further convicted of stalking two women he met online at a youth court following a trial at Stratford Youth Court in October.

The sentencing hearing continues.