The young man responsible for the leak GTA 6 on the internet, you can spend the rest of your life in a hospital. This was the sentence given this Thursday (21) to Arion Kurtaj, aged 18, identified as the author of digital attacks against the game developer Rockstar, in addition to his involvement with a gang that invaded companies such as Uber, Nvidia, LG and even the Brazilian Ministry of Health.
The boy, who has a diagnosis of autism, had been in prison since August, during which time he had violent episodes. Because of this, he did not attend the trial that found him guilty of cybercriminal attacks on technology companies, with losses of more than US$10 million due to the leak of confidential information.
In the view of judge Patricia Lees, who handed down the sentence, Kurtaj is skilled and remains a risk to society, which is why his hospitalization is indefinite. It could be life, unless a doctor at some point deems him no longer dangerous, at which point he could apply for parole.
The boy’s defense stated that, despite the invasion, the leak of information from Grand Theft Auto VI it would not have caused major losses to Rockstar, which even broke a record number of views for the game’s announcement trailer on YouTube. The developer, however, stated that it estimates the losses arising from the scam at US$5 million, both in reputational damage and in the recovery of systems while employees were unable to work.
Young man attacked Rockstar using a Fire TV Stick
It was during a period of probation, in fact, that Kurtaj hacked into Rockstar’s servers. While detained in a hotel in Oxford, UK, he used an Amazon Fire TV Stick device, a television and his cell phone for the attack, which led to the leak of more than 90 gameplay clips of Grand Theft Auto VI.
Before publishing the scenes and source code from old Rockstar games, he used the company’s own Slack messenger to inform about the invasion and request contact within 24 hours. The idea, according to the court, was to extort the developer, charging large sums of money for not disclosing the information obtained — a behavior similar to ransomware attacks, but without locking internal systems.
Criminal intent was a key point in Kurtaj’s trial and also that of a 17-year-old boy, also accused of being part of the Lapsus$ cybercriminal group. The teenager was sentenced to a year and a half in prison in a juvenile rehabilitation center; Both were also indicted for the online stalking and abuse of their young women, the cases of which were not revealed in detail.
- Tired of wasting time looking for low prices?
For Lees, still, the game leak was just the most publicized of the attacks that Kurtaj carried out alongside the so-called Lapsus$ group. Companies like LG, Samsung and Nvidia, as well as government bodies from different countries around the world. In Brazil, for example, the attacks affected the Federal Highway Police, the Ministry of Economy and the Comptroller General of the Union, as well as the Ministry of Health. At the time, the ConecteSUS app was offline for weeks.
The arrest of the young people took place as a result of joint work by authorities from the USA and the United Kingdom; in Brazil, an individual accused of belonging to Lapsus$ was also arrested. The gang operated between 2021 and 2022, but it is not known exactly how much its members profited, as the affected companies did not confirm the payment of ransoms.