A London jury has found that a teenage member of the Lapsus$ hacking group carried out the high-profile cyberattacks on Rockstar Games, Uber, and Nvidia, according to a report from the BBC. The Southwark Crown Court jury found 18-year-old Arion Kurtaj guilty on 12 counts, including blackmail, fraud, and several violations of the UK’s Computer Misuse Act.
Kurtaj was arrested several times within the past two years but continued to carry out cyberattacks on several companies, such as Nvidia, by using social engineering and SIM-swapping techniques. London police arrested Kurtaj for the final time in September 2022 after he violated bail conditions that banned him from using the internet.
According to the BBC, prosecutors told the court that Kurtaj brought an Amazon Fire Stick into the hotel where he was staying, “allowing him to connect to cloud computing services with a newly purchased smart phone, keyboard and mouse.” During that time, Kurtaj released gameplay videos of the not-yet-released Grand Theft Auto VI after threatening its developers, Rockstar Games.
Kurtaj also hacked Uber and the financial company Revolut. According to the BBC, Kurtaj wasn’t fit to stand trial, so the jury was “asked to determine whether or not he did the acts alleged — not if he did it with criminal intent.” The jury also convicted another 17-year-old Lapsus$ member who remains unnamed due to his age. London police also arrested several other teens with ties to Lapsus$ last year.
The Lapsus$ hacks have forced companies and organizations around the globe to rethink their cybersecurity measures. Earlier this month, the US Cybersecurity and Infrastructure Security Agency published a detailed report calling for stricter SIM swapping protections and the transition to a passwordless future in light of the Lapsus$ hacks. The agency said the group gave it a “propitious lens through which we could see systemic issues in the digital ecosystem.”
