The Grand Theft Auto VI leak of September 2022 is one of the most consequential breaches in video game industry history, but its most striking feature is not merely the scale of the data exfiltrated from Rockstar Games. Rather, it is the fact that the principal perpetrator, Arion Kurtaj, executed the intrusion while on police-imposed bail conditions arising from earlier hacks against BT, EE and Nvidia, and while housed under protective arrangements at a Travelodge hotel in Bicester, Oxfordshire (Tidy, 2023a). The Kurtaj case offers a near-unique example of bail conditions failing catastrophically in a cybercrime context, where the offender's tools of harm are not physical implements but commodity consumer electronics and an internet connection. This report examines the sequence of arrests, the bail terms imposed, the manner in which Kurtaj circumvented them, and the broader legal and policy implications of attempting to bail a defendant whose offending is conducted entirely online.
Kurtaj, then 17 and resident in Oxford, was first arrested by City of London Police on 22 January 2022 in connection with the Lapsus$ group's attacks on BT and the EE mobile network in the summer of 2021, during which the group exfiltrated customer data and demanded a $4 million ransom (Tidy, 2023a). Lapsus$ also used stolen SIM details to drain approximately £100,000 from victims' cryptocurrency accounts via SIM-swap attacks. Despite this initial arrest, Kurtaj was released under investigation rather than remanded, a decision consistent with standard practice for a young first-time defendant who had not yet been charged. Within weeks he resumed offending, participating in the February 2022 breach of Nvidia in which approximately one terabyte of proprietary data, including silicon design files and the credentials of more than 71,000 employees, was exfiltrated (Lapsus$, 2025; Goodin, 2023).
Kurtaj was re-arrested on 31 March 2022, along with a 17-year-old co-defendant, following coordinated raids by City of London Police that ultimately resulted in seven arrests of suspected Lapsus$ members aged between 16 and 21 (Lapsus$, 2025). Shortly before this second arrest, Kurtaj had been "doxxed" by rival hackers who published his and his family's contact details, photographs, and personal information online, creating a credible safety risk (Tidy, 2023a). It was this combination of factors — the doxxing-induced safety concern, his autism diagnosis, and his status as a minor at the time of initial offending — that produced the unusual outcome of bail at a Travelodge hotel rather than remand in custody or return to the family home.
The conditions attached to Kurtaj's bail were tailored to the nature of his offending and the protective context of his accommodation. According to court testimony reported by the BBC, the strict conditions included an outright ban on accessing the internet, a prohibition consistent with the standard approach taken by English courts when granting bail to defendants accused of computer-misuse offences under the Computer Misuse Act 1990 (Tidy, 2023a). His laptop had been seized as part of the police investigation, and the Travelodge in Bicester was selected specifically because it removed him from the social and physical environment in which his offending had taken place. The arrangement was intended as a compromise: protective custody that recognised his vulnerability while preventing further criminality through the simple expedient of physical separation from his usual computing infrastructure.
In practical terms, the conditions assumed that hacking required dedicated equipment and that the seizure of his primary device would be sufficient to neutralise his capability. This assumption proved gravely mistaken.
Between his March 2022 arrest and his eventual re-detention in September 2022, Kurtaj remained at the Bicester Travelodge under bail. During this period he conducted what prosecutors described as his "most audacious" hack, breaching Rockstar Games and exfiltrating ninety video clips of unreleased Grand Theft Auto VI gameplay along with associated source code (Tidy, 2023b). The technical means by which he did so are now well documented and demonstrate the inadequacy of equipment-based bail enforcement in a cybercrime context. With his laptop confiscated, Kurtaj improvised: he purchased a new smartphone, a keyboard, a mouse and an Amazon Fire TV Stick, and used the Fire Stick plugged into the hotel television to connect to cloud computing services from which he launched the intrusion (Tidy, 2023b; Tidy, 2023a). City of London Police, executing a search of the hotel room, found the equipment in situ and described Kurtaj as having been "caught red handed" in "flagrant disregard for his bail conditions" (Tidy, 2023a).
The Rockstar intrusion itself was executed using techniques consistent with Lapsus__CONTENT__#39;s broader playbook: social-engineering of internal employee accounts, abuse of session cookies, and multi-factor authentication fatigue attacks of the kind documented in the US Cyber Safety Review Board's August 2023 report (Goodin, 2023). Once inside the Rockstar network Kurtaj posted a message on the company's internal Slack workspace announcing "I am not a Rockstar employee, I am an attacker" and threatening to release source code within 24 hours absent contact via Telegram (Tidy, 2023a). The ninety GTA VI clips were subsequently posted to the GTAForums fan site under the handle "TeaPotUberHacker" on 18 September 2022, triggering one of the largest pre-release leaks in video game history.
The bail breach was treated as a significant aggravating factor at Kurtaj's seven-week trial at Southwark Crown Court, which concluded in August 2023. Because Kurtaj had been assessed by psychiatrists as unfit to plead due to severe autism, the jury was tasked under the Criminal Procedure (Insanity) Act 1964 framework with determining only whether he had committed the acts alleged, not whether he had done so with criminal intent (Tidy, 2023a; Tidy, 2023b). The jury returned positive findings across the charges. At sentencing in December 2023, Her Honour Judge Patricia Lees imposed an indefinite hospital order under section 37 of the Mental Health Act 1983, with a section 41 restriction order, meaning Kurtaj will remain in a secure psychiatric facility for life unless clinicians and the Ministry of Justice agree he no longer poses a danger (Tidy, 2023b). The judge cited the persistence of his offending while on bail, and a mental health assessment stating he "continued to express the intent to return to cyber-crime as soon as possible," as evidence of ongoing risk justifying the indefinite disposal (Tidy, 2023b).
The Kurtaj bail breach exposes a structural problem in the management of cyber-offender defendants. Traditional bail conditions are calibrated to physical-world offending: restraining orders, curfews, geographic exclusions and the seizure of identifiable instruments of crime. Applied to a defendant whose offending requires only an internet-connected display device and a payment card with which to acquire one, these conditions are easily evaded. The Cyber Safety Review Board's review of Lapsus$ noted that the group's success rested less on technical sophistication than on persistence, social engineering, and the ubiquity of cheap consumer hardware capable of accessing cloud services (Goodin, 2023). Kurtaj's Fire Stick is the paradigmatic example: a £40 streaming device, sold in supermarkets, capable when sideloaded of running a web browser and remote-desktop client sufficient to compromise a multibillion-dollar corporation.
Subsequent commentary has suggested that effective bail in serious cyber cases requires either remand, residence in a controlled facility with monitored or absent internet access, or electronic monitoring regimes considerably more intrusive than the standard radio-frequency tag — for example, monitoring of all network traffic at the bail address. Each of these options carries civil-liberties and proportionality concerns that English courts have been reluctant to embrace, particularly for young defendants with mental health vulnerabilities. The Kurtaj outcome arguably illustrates that, where such measures are not available or not imposed, the alternative is not safe bail but continued offending followed by indefinite hospital detention — a far more restrictive outcome than the original bail conditions were designed to avoid.
The bail conditions breach in the Kurtaj case is not a peripheral procedural detail but the central reason the GTA VI leak occurred. Had Kurtaj been remanded in custody after his March 2022 re-arrest, or had his bail conditions included effective restrictions on the acquisition of internet-connected devices, the Rockstar intrusion would in all likelihood not have taken place. The case has become a touchstone in subsequent UK policy discussions about the bail of cyber-offenders, and it informed elements of the Cyber Safety Review Board's recommendations on juvenile cybercrime in August 2023. For Rockstar Games, the consequences extended to a reported $5 million recovery cost, thousands of staff hours, and a months-earlier-than-planned exposure of GTA VI material that would not be officially trailered until December 2023 (Tidy, 2023b).
Goodin, D. (2023) 'How fame-seeking teenagers hacked some of the world's biggest targets', Ars Technica, 10 August. Available at: https://arstechnica.com/security/2023/08/homeland-security-details-how-teen-hackers-breached-some-of-the-biggest-targets/ (Accessed: 14 May 2026).
Lapsus$ (2025) Wikipedia. Available at: https://en.wikipedia.org/wiki/Lapsus%24 (Accessed: 14 May 2026).
Tidy, J. (2023a) 'Lapsus$: Court finds teenagers carried out hacking spree', BBC News, 23 August. Available at: https://www.bbc.co.uk/news/technology-66549159 (Accessed: 14 May 2026).
Tidy, J. (2023b) 'Lapsus$: GTA 6 hacker handed indefinite hospital order', BBC News, 21 December. Available at: https://www.bbc.co.uk/news/technology-67663128 (Accessed: 14 May 2026).
US Cyber Safety Review Board (2023) Review of the attacks associated with Lapsus$ and related threat groups. Washington, DC: Cybersecurity and Infrastructure Security Agency. Available at: https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf (Accessed: 14 May 2026).