GTA 6 lead hacker faces indefinite custody in ‘secure hospital’

Arion Kurtaj, the 18-year-old hacker responsible for the infamous Grand Theft Auto 6 leak from last year, was sentenced to indefinite custody at a “secure hospital,” according to the BBC. Kurtaj was deemed unfit to stand trial due to what BBC called “acute autism,” and will spend the rest of his life at the hospital unless doctors find him “no longer a danger.” He was found guilty on 12 charges that include fraud and blackmail.

Kurtaj is said to be a member of an international hacking group called Lapsus$, which has claimed responsibility for hacks at Uber, Nvidia, and Rockstar Games. All together, the companies said the damage caused by the hack cost them “nearly $10 million,” according to the BBC. Rockstar Games said it spent $5 million on its recovery after the hack, plus thousands of hours by its staff.

Rockstar Games has not responded to Polygon’s request for comment.

Kurtaj was reportedly on bail after hacking Nvidia when he got into Rockstar Games’ company Slack channel “using an Amazon Firestick, his hotel TV and a mobile phone,” BBC reported. He was able to download and later share more than 90 video clips of the in-development game. Nearly an hour’s worth of footage was published on a Grand Theft Auto forum. The footage confirmed a Bloomberg report that said the game would be set in fictionalized Miami, better known as Vice City in the franchise, and feature a playable female character. GTA 6’s first trailer revealed that this character is called Lucia, and paired up with another lead named Jason. (The GTA 6 trailer was leaked early, too.)

Even with the leak, Rockstar racked up more than 90 million views in less than 24 hours after its trailer was published. Two weeks since its debut, the trailer has 155 million views. Kurtaj’s lawyers argued that the success of the GTA 6 trailer showed that the hack did not cause extensive harm to Rockstar Games, but the judge didn’t agree, noting that Kurtaj caused harm to multiple other people and companies, too — and has expressed a desire to continue hacking. Likewise, Kurtaj was reportedly violent in custody, BBC said, with “dozens of reports of injury or property damage” to his name since the arrest.

A 17-year-old Lapsus$ member was sentenced, too; he’ll be held for 18 months under a “youth rehabilitation order,” which BBC said requires “intense supervision and a ban on using VPNs online,” because of the hack and what the judge called an “unpleasant and frightening pattern of stalking and harassment” of two women.

The U.S. Cybersecurity and Infrastructure Security Agency put out a report on Lapsus$ in July 2023, analyzing the group's activity from 2021 to 2022. “Lapsus$ drew the attention of cybersecurity professionals and the press almost immediately after providing unparalleled transparency into the inner workings of how it targeted organizations and individuals, organized its attacks, and interacted within itself and with other threat groups,” CISA wrote in the report. “Its mindset was on full display for the world to see and Lapsus$ made clear just how easy it was for its members (juveniles, in some instances) to infiltrate well-defended organizations.” The group is thought to be largely teenagers, according to CISA; the two members sentenced Thursday are the only two who’ve been caught.

News of the GTA 6 hackers’ sentencing comes days after Sony Interactive Entertainment studio Insomniac Games had a massive amount of data released following a hack by ransomware group Rhysida. In-development gameplay footage of Wolverine, an anticipated upcoming game, was released alongside extensive employee and contractor personal data.

Correction (Dec. 22): This article’s headline has been changed to more accurately reflect the length of Kurtaj’s sentence.