Teenage Grand Theft Auto 6 hacker given an indefinite sentence in a secure hospital due to his 'intent to return to cybercrime as soon as possible'

A BBC report says that the 18-year-old hacker who was found responsible for committing a series of attacks on tech firms that included the theft and leak of Grand Theft Auto 6 footage in 2022 has been sentenced to an indefinite period in a secure hospital.

Arion Kurtaj was found responsible for the attacks on Rockstar, Nvidia, and other tech firms as part of the Lapsus$ group in August. Following an assessment by a psychiatrist, however, the judge in the case determined that Kurtaj was unfit to stand trial, and so the jury was asked only to determine if he had actually committed the hacks, but not whether it was done with criminal intent.

Kurtaj's mental health assessment determined he has "acute autism" and said he's "highly motivated" and "continued to express the intent to return to cybercrime as soon as possible." Kurtaj carried out his Rockstar hack while he was on bail and in police custody at a Travelodge hotel for previous hacks, using just an Amazon Fire Stick, the hotel television, and a mobile phone.

The judge in the case said Kurtaj's skills and determination to do crime make him a high risk to the public, and so he will remain in a secure hospital for life, unless and until doctors determine that he's no longer a danger.

"Danger" might seem like a strong term for a guy who leaked some videogame footage, but while the GTA 6 hack was Kurtaj's highest-profile crime from a gamer perspective, it was far from his only one. The Lapsus$ group also hacked Microsoft, Samsung, Nvidia and UK telecom company BT&EE, and stole millions in cryptocurrency from individuals. Kurtaj was also reportedly violent while in custody, causing "dozens" of reports of injuries and property damage. 

A 17-year-old juvenile member of Lapsus$ who had worked with Kurtaj and others on some hacks was found guilty in the same trial. Along with the hacks, the teen was also sentenced for stalking and harassing two young women: Because he's a minor (which is also why he can't be named), the 17-year-old was given an 18-month Youth Rehabilitation Order, a community sentence for offenses that fall short of requiring imprisonment.

Kurtaj and the 17-year-old are the first members of Lapsus$ to be convicted, but likely won't be the last: Seven teenagers connected to Lapsus$ were arrested in the UK in 2022, and the BBC report says more members are thought to remain at large.