Autistic teenager behind series of Lapsus$ hacks sentenced to indefinite hospital stay

Arion Kurtaj, a teenager described as a key member of the Lapsus$ group, was sentenced Thursday to indefinite hospitalization for a series of high-profile hacks last year.

Kurtaj, aged 18 and suffering from severe autism, was deemed unfit to stand trial by psychiatrists. In August, a jury find that he had committed the hacks. Because of his condition, jurors were only asked to determine whether he committed them rather than whether he was guilty of them.

The teenager entered the systems of ride-sharing company Uber, financial technology company RevolutAnd the developer of Grand Theft Auto – while using an Amazon Fire Stick connected to a hotel room TV, the court heard – in a series of successive incidents while he was already on bail for others hacks in September 2022.

Kurtaj will remain in a secure hospital for life or until doctors believe he no longer poses a danger to society, with Judge Patricia Lees at Southwark Crown Court saying he remained “determined to commit crimes.” other serious offenses if the opportunity arises.

The court was also told that while in custody, Kurtaj had been violent, leading to dozens of reports of injuries and property damage.

A co-defendant in the same trial, who cannot be named because of his age, was also convicted in August. The 17-year-old was sentenced to a youth rehabilitation order for 18 months that restricted his use of the internet due to what the judge called a “pattern of harassment and harassment that is unpleasant and frightening.”

The Lapsus$ gang became famous for their brazen hacks that often involved extensive social engineering and very little, if any, technical ability to exploit vulnerabilities.

A number of suspects remain at large, although prosecutors said investigators tracked down the two British teenagers after solving the IP addresses used for a number of email and telegram accounts the two men used to communicate. brag about their antics.

A series of high-profile cyberattacks carried out by a broader group of teenage hackers from the Lapsus$ gang in 2021 and 2022 have been described as highlighting systemic weaknesses in the telecommunications sector by the US Department of Homeland Security. goodbye.

Alexander Martin is the UK editor of Recorded Future News. He was previously a technology journalist for Sky News and is also a member of the European Cyber ​​Conflict Research Initiative.