You will probably remember the case of the GTA 6 leaksthe highly anticipated game from Rockstar Games due out in 2025. The person responsible turned out to be Arion Kurtasan eighteen-year-old hacker belonging to the group Falla gang of cybercriminals, very young at that, who usually create havoc on the web.
Kurtaj was deemed unfit for trial, and will now spend his life in a psychiatric hospital.
The case of the GTA VI leaks: what happened
In 2022, some appeared online unpublished images of the new game in the Grand Theft Auto saga. Blatantly pictures stolen from developer Rockstar Games who, at the time of the facts, was working in secret on the title (just think that the first official trailer for GTA 6 arrived only a few weeks ago).
Investigations revealed that the person responsible was a member of the cybergang Fall, going back to the name of Arion Kurtaj. A name not new to the British authorities, as the young man already existed on probation for hacking Nvidia and BT/EE servers. It was during this period, while under protection at a Travelodge hotel, that he committed what would become his most famous hack.
In fact, although his laptop had been confiscated, Kurtaj managed to hack Rockstar Games’ private servers. Come? Using a smartphone and the hotel’s Amazon Firestick TV.
The hacker entered Rockstar Games’ internal messaging system (Slack), stealing approximately 90 videos of the highly anticipated video game. Then, on the same app, he wrote “if Rockstar doesn’t contact me on Telegram within 24 hours I will start releasing the source code”. He eventually posted the videos and source code on a forum under the username TeaPotUberHacker. Kurtaj was immediately arrested and detained until trial.
The hacker in the GTA 6 leak will spend his life in a mental institution
The US court that heard the case found that Kurtaj, suffering from acute autism, was unable to face the trial. He also felt that the eighteen year old as a high risk element for societyfor his hacking skills and his talent for committing cybercrimes.
The psychiatric report states that the young man, due to his conditions, is not fit to stand trial in court. Kurtaj’s violent attitudes would also have had an impact, with dozens of reports of injury or property damage during the period of remand.
“He continued to express an intent to return to cybercrime as soon as possible. He is highly motivated,” we read in the report (Source: BBC).
Meanwhile, at the beginning of December 2023, Rockstar Games published the first official trailer for GTA 6. A video that in just 4 days it obtained 128 million views on YouTube.
Kurtaj’s defense exploited (or at least attempted to exploit) the success of the official trailer to downplay the accusations, arguing that the defendant had caused no obvious harm to the developer. However Rockstar Games countered by stating that the hack cost the company over $5 millionto which must be added the additional hours of work that the developers had to spend working on the game after the leak.
Kurtaj will remain in a maximum security psychiatric hospital for his entire life, unless doctors correct their position on his dangerousness.
Who are the young Lapsus$ hackers?
As mentioned above, Rockstar Games was not the only company to suffer cyber attacks from the group known as Lapsus$. In the past Kurtaj and other gang members had already hacked the tech giant Nvidia and the telephone company BT/EE. In both cases they stole sensitive information, demanding a ransom (which was never paid). There were other attacks instead aimed at private individuals, targeting several e-wallets containing cryptocurrencies. Hacking attempts against Microsoft and the fintech giant Revolut are also traced back to the group.
From the investigations it appears clear that Lapsus$ is composed mainly by teenagers, as confirmed by the fact that another defendant, whose name is not known because he is a minor, has only 17 years. The latter was judged guilty for helping Kurtaj in attacks on Nvidia and BT/EE. Specifically, the judge gave him an 18-month youth rehabilitation order, which includes intense supervision and a ban on using VPNs online.
In addition to the hacking crimes, the boy was also convicted of what the judge called “an unpleasant and appalling pattern of stalking and harassment” against two young women.
Throughout their activity, Lapsus$ hackers have regularly celebrated their crimes on social media, mocking victims on their Telegram channels. The posts are in both English and Portuguese. In fact, the young group is believed to be made up of English and Brazilian guys
“The gang’s audacious attacks in 2021 and 2022 have shocked the world of cybersecurity,” writes the BBC.
