18-year-old hacker, Arion Kurtaj, has been sentenced to life in a hospital prison for his role in leaking footage from the highly anticipated game, Grand Theft Auto VI.
Kurtaj, a member of the international hacking group Lapsus$, was arrested in Oxford in September 2022, following one of the more infamous cyberattacks in recent history that saw him breach major companies such as Nvidia, Microsoft, Samsung, and Uber. His most notable act was the leak of in-development footage from Rockstar Games’ upcoming title, Grand Theft Auto 6, which had remained one of the most closely guarded secrets in the gaming industry.
Despite suffering from acute autism, which made him unfit to stand trial, a jury found Kurtaj responsible for the attacks. The court heard that he managed to hack into Rockstar’s systems using simple tools such as an Amazon Firestick, a TV in a hotel, and a mobile phone, even while under police protection at a Travelodge hotel. He then threatened to release the GTA 6 source code unless Rockstar negotiated with him.
The aforementioned leak was massive, involving the game’s source code and 90 clips of unfinished assets and other in-development elements. The videos quickly spread across the internet, revealing many mysterious details while still a work in progress. Rockstar confirmed the hack and took swift action to remove the leaked videos, emphasizing the breach’s seriousness.
During the sentencing, the BBC reported that a mental health assessment found Kurtaj “continued to express the intent to return to cybercrime as soon as possible,” and he was deemed “highly motivated.” He was also reportedly violent in custody, leading to the decision for him to be held in a secure hospital for life, with release only possible if doctors determine he is no longer a threat.
The GTA 6 hack, though initially seen as a sensational revelation of the game’s content, had far-reaching consequences for Rockstar Games. The company claimed that the hack cost them $5 million and thousands of staff hours.
Despite arguments from Kurtaj’s defense about the lack of measurable negative impact on Rockstar, as shown by the record-breaking success of the GTA 6 trailer, the judge ruled that real people and companies were significantly harmed by Lapsus$’ actions.
Arion Kurtaj’s case is a stark reminder of the complexities surrounding cybercrime, especially in the gaming industry, where leaks can have huge implications for developers and fans alike. His sentencing also highlights the challenges in balancing mental health issues with the need to protect the public and intellectual property.
Insomniac Games was recently victimized by an arguably worse hacking incident. The first-party Sony studio saw its future plans leaked online. The good news is plenty have offered support for the studio through these trying times. Finally, the reception to its planned games, including Venom: Lethal Protector, Marvel’s Wolverine, and a lineup of X-Men titles, have been mostly positive.
