Hacker behind 2022 Rockstar breach given indefinite hospital order, reports say

Arion Kurtaj, the 18-year-old Lapsus$ member found responsible for the September 2022 intrusion at Rockstar Games, has been ordered to stay in a secure hospital with no fixed release date. The order came from Judge Patricia Lees at Southwark Crown Court, according to VGC, citing Bloomberg, and The Record.

A hospital order, not a prison term

Some early headlines spoke of a life sentence. That is not quite what happened. Kurtaj will be held until a mental health tribunal decides he is no longer a danger to others, VGC reported, so there is no set term in either direction. The judge said he still posed "a high risk of serious harm to the public," and Kotaku reported that a mental health assessment found he "continued to express the intent to return to cybercrime as soon as possible."

Psychiatrists had found Kurtaj, who is autistic, unfit to stand trial. When the jury ruled in August, it was asked only whether he carried out the hacks, not whether he intended a crime. Besides Rockstar, the reports link the hacks to Uber and Nvidia, and The Record also names Revolut.

A 17-year-old co-defendant, who cannot be named because of his age, received an 18-month youth rehabilitation order that restricts his internet use, The Record reported.

Background

Kotaku reported that Kurtaj's lawyers pointed to the record response to GTA VI's first trailer as a sign the breach did Rockstar limited harm. None of the reports we read carried a comment from Rockstar or Take-Two on the sentence.