Adolescent Autistic Lapsus$ Member Sentenced To London Court For Hacking Uber And Revolt

Arion Kurtaj, charged by the court with 17 counts of hacking. (photo: twitter @KifflomGames)

JAKARTA - An autistic teenager, who was a member of the Lapsus$ hacker group, was found guilty by a London jury on Wednesday, August 23 for hacking Uber and fintech company Revolut. He is also accused of extortion against best-selling video game developer Grand Theft Auto.

Arion Kurtaj, who is 18 years old, carried out a cyberattack himself in September 2022 while being released on police guarantees for previous offenses.

According to prosecutors, he targeted Revolut, accessed information about 5,000 Revolut customers, and two days later targeted Uber, causing nearly $3 million in losses to Uber.

Revolut declined to comment. Uber also did not immediately respond to requests for comment from the media.

Kurtaj then hacked Rockstar Games and threatened to release the company's planned Grand Theft Auto sequel code for the company via Slack's message to all Rockstar staff.

The judges at the Southwark Crown Court were shown a snippet of Grand Theft Auto's latest game, which was hacked by Kurtaj and uploaded to the online game forum.Rockstar did not immediately respond to a request for comment.

Since Kurtaj, who has autism, is judged by psychiatrists unable to undergo trial, the jury is asked to determine whether he has committed the act rather than giving a guilty or innocent verdict.

Kurtaj has previously hacked and extorted the largest broadband service providers in the United Kingdom, BT Group, and mobile operator EE by 2021, demanding a ransom of US$4 million (Rp60 billion) or he will remove data from their servers.

He also hacked chipmaker Nvidia Corp in February 2022, took about a terabyte of sensitive data, released about 80 gigabytes and threatened to publish the rest.

Prosecutors said that Kurtaj and a 17-year-old teenager, who could not be named for legal reasons and his case was tried at the same time as Kurtaj, were "major actors" in Lapsus$.

On Wednesday, the jury found Kurtaj guilty of 12 counts, including three counts of extortion, two counts of fraud, and six counts under the Law on Illegal Computer Use.

The 17-year-old was found guilty of one charge of fraud, one charge of extortion, and one charge under the Law on Illegal Computer Use linked to Nvidia.

He was found not guilty on one charge of extortion and one charge under the Law on Illegal Computer Use related to BT.

The 17-year-old has previously acknowledged one charge under the Law on Illegal Computer Use and one charge of fraud related to hacking the London City Police's cloud storage, weeks after police arrested him in 2022.