A teenage member of the Lapsus$ hacking group was on Wednesday found by a UK jury to have hacked Uber and fintech firm Revolut then blackmailed the developers of best-selling videogame Grand Theft Auto.
Arion Kurtaj (18) embarked on a solo cyber crime spree in September 2022, first targeting Revolut before hacking Uber two days later.
Kurtaj and a 17-year-old who cannot be named for legal reasons, were described by the prosecution as the “key players” in the LapsusS hacking group.
Psychiatrists had assessed Kurtaj as unfit to stand trial so the role of the jury in his case was to decide whether he had committed the acts alleged against him.
On Wednesday, following a two-month trial at London’s Southwark Crown Court plus nine hours and 19 minutes of deliberations, a jury unanimously found Kurtaj had carried out 12 offences in his spree of innovative hacks.
These offences included six counts of carrying out an unauthorised act to impair the operation of a computer, three counts of blackmail, two fraud offences, and of failing to comply with a section 49 notice to disclose a key when he did not give up the password to his mobile phone when asked to by police.
He tried to blackmail Rockstar Games by threatening to “leak the stolen source code for the Grand Theft Auto sequel onto internet forums”, the indictment stated.
Kurtaj and the youth were also accused of hacking software company Nvidia in February 2022 before threatening to “release Nvidia Corporation’s intellectual property on to the web” if it did not pay them.
The 17 year-old showed no emotion as he was found guilty of one count of fraud, a charge of blackmail and also of having carried out an unauthorised act to impair the operation of a computer.
His mother wept uncontrollably after the verdicts were read out.
Prosecutors alleged Kurtaj and the 17-year-old, aided by unknown associates, hacked the servers and data files of broadband provider BT and mobile operator EE before demanding a $4 million ransom on August 1st, 2021.
But the 17-year-old was found not guilty of a charge of have carried out an unauthorised act to impair the operation of a computer and a further charge of blackmail in relation to BT.
He previously pleaded guilty to one offence under the UK's Computer Misuse Act and one count of fraud.
Neither defendant gave evidence during the jury trial.
Sentencing dates at the same court have yet to be fixed for either defendant.
A case management hearing has been set for Kurtaj on September 21st, while it is hoped that a sentencing date may be fixed for the 17-year-old on November 9th.
During the trial, the court was told that Kurtaj had been living in care since the age of 14 and had been housed for a period in a Travelodge “for his own protection”.
Kurtaj’s defence counsel David Miller described the youngster as “the most vulnerable of adolescents” who was now pitted against huge companies and corporations worth billions, who had unlimited funds and unlimited resources including the FBI, National Crime Agency, Interpol and City of London Police.
During closing speeches, he told the jury: “Keep in mind Arion Kurtaj’s psychological make-up, and in particular his psychological condition, his education or lack thereof – could he be the highly intelligent, competent genius that the prosecution set out at the beginning?”
After the verdicts, Detective Superintendent Richard Waight, of the City of London Police, said: “This has been a complex and sensitive investigation involving a multi-agency response and there have been a number of challenges throughout the police investigation and judicial process.
“We thank the judge and jury for being patient throughout the trial, during deliberations and for the subsequent verdicts.”
