18-year-old Arion Kurtaj hacked Rockstar Games using just an Amazon Firestick, mobile phone and hotel TV

A teenager, Arion Kurtaj, 18, diagnosed with autism, has been handed an indefinite hospital order after stealing 90 clips of the yet-to-be-released Grand Theft Auto 6 game during a hacking spree.

Kurtaj, previously on bail for hacking Nvidia and BT/EE, and under police protection at a Travelodge hotel, proceeded to breach Rockstar Games, the company responsible for GTA, according to court proceedings.

In defiance of having his laptop confiscated, Kurtaj managed to carry out his cyber attack using an Amazon Firestick, his hotel television, and a mobile phone.

He infiltrated the company’s internal Slack messaging system, declaring, “If Rockstar does not contact me on Telegram within 24 hours, I will start releasing the source code.” A member of the Lapsus$ hacking group from Oxford, Kurtaj posted the clips and source code on a forum.

As revealed in Southwark Crown Court, he will be held in a secure hospital indefinitely unless medical professionals determine he is no longer a threat.

This case has prompted City of London police to advise parents to monitor their children’s internet usage.

The court learned that Kurtaj exhibited violent behavior while in custody, with numerous reports of injuries or property damage. Due to his acute autism, doctors deemed him unfit to stand trial, and the jury was tasked with determining whether he committed the alleged acts, not assessing criminal intent.

A mental health assessment presented during the sentencing hearing revealed that he “continued to express the intent to return to cyber-crime as soon as possible,” emphasizing his high motivation.

Another member of Lapsus$, aged 17 and protected by legal anonymity, was convicted in the same trial. He faced charges of two counts of fraud, two offenses under the Computer Misuse Act, and one count of blackmail.

In the sentencing at Guildford Crown Court in Surrey on Thursday, he received a youth rehabilitation order. The order includes an 18-month supervision requirement, a six-month rehabilitation requirement, and a three-month intensive supervision and surveillance requirement.

DCS Amanda Horsburgh, representing the City of London police, remarked, “This case serves as an example of the dangers that young people can be drawn towards while online and the serious consequences it can have for someone’s broader future.

Many young people wish to explore how technology works and what vulnerabilities exist. This can include learning to code, interacting with like-minded individuals online, and experimenting with tools. Unfortunately, the digital world can also be tempting to young people for the wrong reasons.

The gang’s cyber attacks between August 2020 and September 2022 affected a telecoms company, a computer parts manufacturer, gaming companies, and others.

Rockstar Games informed the court that the hack cost it $5m to recover from, in addition to thousands of hours of staff time.”