A teenage hacker who caused £7million of damage to the firm behind Grand Theft Auto, has vowed to return to crime when he is freed from jail.
18-year-old Arion Kurtaj reportedly stole code and video footage from Rockstar’s development of their latest installment of the hit crime shooter franchise, GTA VI, as part of the multi-million-pound blackmail campaign.
Defiant tech crook Kurtaj, who is a key member of Lapsus$ cyber-crime group, also blackmailed telecoms firm BT/EE, demanding a $4million (£3.19million) ransom, according to Mail Online.
He carried out the crime alongside a 17-year-old, who cannot be named. They hacked computer chip maker NVIDIA, Uber, and the online bank Revolut, between July 2021 and February 2022.
A jury convicted Kurtaj, from Oxford, of 12 different offences following a seven-week trail in August. However, a sentencing hearing today heard the 18-year-old wanted to return to a life of crime after he is released.
Psychiatrist Dr Claudia Camden-Smith, who assessed Kurtaj, was asked by prosecutor Kevin Barry if he was ‘highly motivated to return to offending?’ Dr Camden-Smith replied: ‘That is what he told me the last time I saw him.’
The teen, who has been in custody since September last year, appeared at his latest court hearing today via video-link from Feltham young offenders’ institute.
His 17-year-old co-accused was also convicted of carrying out an unauthorised act relating to hacking, fraud, and blackmail in relation to Nvidia. He had admitted two offences under the Computer Misuse Act and one count of fraud in relation to BT.
Judge Patricia Lee is due to sentence the pair at Southwark Crown Court later but said Kurtaj will be detained under the Mental Health Act.
The Judge made an interim hospital order for the next 12 weeks and said she was satisfied Kurtaj is suffering from mental illness.
‘It may be appropriate then for a hospital order to be made,’ she said.
Mr Barry said the hacks on Rockstar, Nvidia, and Uber cost the firms around £7.4million ($9.3million) in damage alone.
Referring to the attack on Rockstar the prosecutor added: ‘This material was highly confidential as the game is a billion-dollar franchise and the latest instalment is hotly anticipated.
‘He published some of the stolen footage taken during the hack on online forums and blackmailed Rockstar Games that he would release the precious source code which forms the building blocks of the game unless they contacted him – presumably to discuss ransom payment.’
Mr Barry said Kurtaj was involved ‘to a deeper extent than the 17-year-old’ and has vowed to carry on hacking if he he is let out of jail.
‘Mr Kurtaj is determined to commit further offences if he gets the opportunity to do so. That determination is undimmed by spending time in custody over the last year.’
Mr Barry earlier told the court: ‘The victims in this case, and they undoubtedly were victims, were members of the public who suffered the sim swap frauds.
‘There were also big corporations who were targeted and attacked.
‘There is no suggestion that any of these attacks were carried out by individuals out for larks and jokes.
‘It is evident that those involved were deadly serious in stealing data and profiting from that, sometimes on a truly huge scale, either by blackmail or fraud.
‘There is no suggestion that these were victimless crimes – quite the opposite is the case.
‘Customers had their data stolen and had their sims swapped and used by criminals including, the prosecution say, the defendants.
‘The consequences of that fraud were that they found their lives turned upside down, accounts ransacked and drained.
‘Life savings taken, sometimes amounting to tens of thousands of pounds… These were real-world losses suffered by individuals.’
Mr Barry said Kurtaj worked as part of a team and helped to compromise the systems of a number of firms, disrupting services for more than 8,000 customers.
On one website Kurtaj had automated the words ‘f**k me daddy’ to appear on screen. Another saw a picture of a penis appear.
Mr Barry described this as a ‘hallmark of Arion Kurtaj’.
In one blackmail demand, Kurtaj wrote to the mobile network operator EE: ‘We are Lapsus$. Remember our name. We have your user data.
‘We have EE, BT and Orange source codes. If EE pay us four million USD before 20 August we will delete everything from our servers.’
Mr Barry added: ‘The defendants used a significant level of hacking and engineering. They knew what they were doing and undertook significant attempts to cover their tracks.
‘Considerable attempts were made to conceal their identities. They engaged in a complex process, following a large number of chains of evidence. Snippets of material were found to trace the material back to the defendants.
‘On many occasions they appear to have concealed their identities skillfully and well.’
David Miller, defending Kurtaj, described the teenager as a ‘genius’ who ‘faces spending decades in a secure environment at the taxpayers expense.
‘There must be a better way to utilise the skills he has.’
Mr Miller said it was ironic he targeted the makers of GTA, the world’s most successful ever video game where the object is to ‘rob gangs and build gangs’.
Judge Patricia Lee noted there would be companies that would be interested in employing Kurtaj if he could be rehabilitated.
‘He is not someone they could currently work with. He needs to make the choice to work hard and he could achieve that, potentially. That would be a very different future for him.’
The sentencing hearing continues.
