Arion Kurtaj, an 18-year-old from Oxford, England, is one of the hackers behind the massive leak of Grand Theft Auto VI footage last year. He was part of the Lapsus$ hacking group that targeted several companies, including Rockstar Games, Uber, and Nvidia. He used social engineering and SIM-swapping techniques to gain access to their networks and data. He was recently found guilty on 12 counts, including fraud and blackmail, by a London jury.
How He Hacked Rockstar Games and Leaked GTA 6
Kurtaj was arrested several times within the past two years but continued to carry out cyberattacks on various companies. He was placed in a hotel by police after hacking Nvidia and having his identity and location exposed by rival hackers. It was from this hotel room that he targeted Rockstar Games, the developer of the popular Grand Theft Auto series.
He hacked into Rockstar’s messaging service Slack and threatened to leak the source code of the upcoming GTA 6. He also posted a message saying: “I am not a Rockstar employee, I am an attacker.” He then released close to 100 different videos of the game online, revealing details such as the return to Vice City and the inclusion of a female protagonist. The leak caused a huge uproar among GTA fans and a major headache for Rockstar Games.
How He Hacked Uber and Revolut
Kurtaj was not only interested in gaming companies. He also hacked Uber and Revolut, a financial company. He used SIM-swapping to take over the phone numbers of employees and customers of these companies. He then used these numbers to access their accounts and steal personal information, such as credit card details and passwords. He also blackmailed some of his victims, demanding money or cryptocurrency in exchange for not leaking their data.
How He Was Caught and Convicted
Kurtaj was caught red-handed by the City of London Police when they searched his hotel room and found his hacking tools: an Amazon Fire Stick in the hotel TV and a smartphone, keyboard, and mouse. He had violated his bail conditions that banned him from using the internet. He was arrested for the final time in September 2022.
He was deemed psychiatrically unfit to stand trial, so the jury was asked to determine whether or not he did the acts alleged, not if he did it with criminal intent. The jury found him guilty on 12 counts, including blackmail, fraud, and several violations of the UK’s Computer Misuse Act. He will be sentenced at a later date. Another 17-year-old Lapsus$ member who remains unnamed due to his age was also convicted by the jury.
How His Hacks Have Impacted the Digital Ecosystem
The Lapsus$ hacks have forced companies and organizations around the globe to rethink their cybersecurity measures. Earlier this month, the US Cybersecurity and Infrastructure Security Agency published a detailed report calling for stricter SIM-swapping protections and the transition to a passwordless future in light of the Lapsus$ hacks. The agency said the group gave it a “propitious lens through which we could see systemic issues in the digital ecosystem.”
Arion Kurtaj is one of the most notorious teenage hackers in recent history. His hacks have exposed the vulnerabilities of some of the biggest companies in the world and have leaked confidential information about one of the most anticipated games ever. His case shows how cybercrime can have serious consequences for both individuals and businesses.