In mid-2023, Southwark Crown Court in London hosted one of the most closely watched cybercrime trials in recent British legal history. At its centre stood Arion Kurtaj, an 18-year-old from Oxford, and an unnamed 17-year-old co-defendant, both of whom were tied to the Lapsus$ international hacking collective. The trial focused, in large part, on the September 2022 breach of Rockstar Games that resulted in the unauthorised publication of approximately 90 video clips of Grand Theft Auto VI in early development — widely described as one of the largest leaks in video-game industry history (MacDonald, 2022; Wikipedia, 2026). The proceedings ran for roughly seven weeks at Southwark Crown Court and culminated in a jury determination in August 2023 (Tidy, 2023).
Kurtaj's path to the dock was unusual. He had already been arrested in January 2022 in connection with hacks against BT and EE, then re-arrested in March 2022 following the Nvidia breach. Released on strict bail conditions — including a prohibition on accessing the internet — he was relocated to a Travelodge hotel in Bicester under police protection after being doxxed by rival hackers (Tidy, 2023). It was from this hotel room that Kurtaj allegedly conducted his "most audacious" attack, breaching Rockstar Games using a newly purchased smartphone, a keyboard, a mouse, and an Amazon Fire TV Stick connected to the hotel television (Tidy, 2023; Wikipedia, 2026). He then posted a message on Rockstar's internal Slack to every employee, declaring "I am not a Rockstar employee, I am an attacker" and threatening to release the GTA 6 source code unless the company contacted him within 24 hours (Tidy, 2023).
By the time the case reached Southwark Crown Court in mid-2023, Kurtaj faced twelve offences — six counts of computer misuse under the Computer Misuse Act 1990, three counts of blackmail, and two counts of fraud (Wikipedia, 2026). Crucially, psychiatrists evaluating Kurtaj concluded that he was not fit to stand trial owing to his autism. As a result, the proceedings were not conventional: rather than determining criminal guilt and intent, the jury was instructed under section 4A of the Criminal Procedure (Insanity) Act 1964 to decide whether Kurtaj had "done the acts" alleged in each count (Tidy, 2023; MacDonald, 2022). Kurtaj therefore did not appear to give evidence. The co-defendant, also autistic, was similarly tried but cannot be named owing to reporting restrictions protecting his age.
Prosecution lead barrister Kevin Barry presented evidence drawn from Telegram chat logs, Slack messages, City of London Police searches of Kurtaj's hotel room, and forensic computer evidence. Jurors were shown how the gang used social-engineering tricks — including calling helpdesks while impersonating staff and spamming employee phones with MFA approval requests until exhaustion compelled approval — to penetrate companies including Microsoft, Revolut, Uber, Nvidia and Rockstar (Tidy, 2023). The court heard that the defendants had stolen approximately £100,000 in cryptocurrency through SIM-swap attacks. Barry characterised Kurtaj's conduct as displaying a "juvenile desire to stick two fingers up to those they are attacking" (Tidy, 2023). On 23 August 2023, the jury concluded that Kurtaj had committed all the alleged acts; the co-defendant was found to have committed offences relating to the earlier Lapsus$ activity (Tidy, 2023; Wikipedia, 2026).
Because Kurtaj had been found to have done the acts rather than convicted in the orthodox sense, sentencing options were restricted to those available under the 1964 Act. In December 2023, the presiding judge — Her Honour Judge Lees — placed Kurtaj under an indefinite hospital order pursuant to the Mental Health Act 1983, reasoning that he presented a high and continuing risk to the public, having expressed an intention to resume cybercrime upon release (Wikipedia, 2026; MacDonald, 2022). Take-Two Interactive subsequently disclosed that the Rockstar breach had cost the company roughly USD $5 million and thousands of staff hours to remediate (Wikipedia, 2026).
The trial drew international attention because it laid bare both the technical fragility of major corporations and the youth of the offenders responsible. The US Cyber Safety Review Board released a contemporaneous report observing how easily Lapsus$ — composed substantially of juveniles — had penetrated "well-defended organisations" (Tidy, 2023). For the games industry, the Southwark proceedings provided the first formal judicial accounting of the GTA 6 leak, vindicating Rockstar's characterisation of the incident as a serious criminal breach rather than a routine data spill.
MacDonald, K. (2022) 'Rockstar owner issues takedowns after Grand Theft Auto VI leak', The Guardian, 19 September. Available at: https://www.theguardian.com/games/2022/sep/19/rockstar-owner-issues-takedowns-after-grand-theft-auto-vi-leak (Accessed: 14 May 2026).
Tidy, J. (2023) 'Lapsus$: Court finds teenagers carried out hacking spree', BBC News, 23 August. Available at: https://www.bbc.com/news/technology-66549159 (Accessed: 14 May 2026).
Wikipedia (2026) Grand Theft Auto VI. Available at: https://en.wikipedia.org/wiki/Grand_Theft_Auto_VI (Accessed: 14 May 2026).