The Lapsus$ hacking trial held at Southwark Crown Court in London during summer 2023 placed three discrete blackmail charges at the centre of the Crown's case against teenager Arion Kurtaj, the 18-year-old Oxford resident identified as the group's prominent member known as "White". Whereas the wider indictment included fraud counts and offences under the Computer Misuse Act 1990, it was the three counts of blackmail under section 21 of the Theft Act 1968 that most clearly described the extortion-driven business model of Lapsus$. Each count corresponded to a distinct corporate victim and a distinct unwarranted demand backed by menaces, namely the joint attack on BT Group and EE, the breach of Nvidia Corp, and the audacious raid on Rockstar Games that produced the Grand Theft Auto VI (GTA 6) leak (Tobin, 2023; BBC News, 2023a). A co-defendant, a 17-year-old who cannot be named for legal reasons, faced two of those same blackmail counts relating to BT/EE and Nvidia, having been arrested alongside Kurtaj before Kurtaj continued offending on bail (Tobin, 2023).
The first blackmail count concerned the duo's earliest joint operation. Prosecutor Kevin Barry told jurors that Kurtaj and the unnamed 17-year-old, who had met online in July 2021, breached the servers and data files of telecommunications giant BT and its mobile subsidiary EE before issuing a demand for a $4 million (£3.1 million) ransom on 1 August 2021 (BBC News, 2023a). No ransom was ever paid by BT, but the pair leveraged stolen SIM details from five victims to siphon roughly £100,000 from cryptocurrency accounts secured by the compromised SIMs, and the City of London Police later released images of the threatening text messages sent to 26,000 EE customers as part of the pressure campaign (BBC News, 2023a). The unwarranted demand backed by menaces — pay or face data publication and customer disruption — formed the textbook basis of the first count, and both defendants were initially arrested on 22 January 2022 in connection with this attack before being released under investigation (BBC News, 2023a; Tobin, 2023).
The second blackmail count related to the February 2022 intrusion into Nvidia, the Silicon Valley chip designer. After the duo were released on bail they resumed offending with Lapsus$ associates, exfiltrating around one terabyte of data and threatening to release the "complete silicon, graphics, and computer chipset files for all recent NVIDIA GPUs" unless Nvidia complied with their demands (Goodin, 2023; Wikipedia, 2026). Notoriously, the group also demanded that Nvidia open-source its GPU device drivers and remove cryptocurrency-mining limiters on its cards, an unconventional twist that the Cyber Safety Review Board later highlighted as evidence of Lapsus__CONTENT__#39;s "flashes of creativity" (Goodin, 2023). Court evidence included Telegram group chats showing the gang directing a hired caller to phone the Nvidia helpdesk impersonating an employee in order to obtain login credentials (BBC News, 2023a). Kurtaj and the 17-year-old were re-arrested on 31 March 2022 in connection with this count (BBC News, 2023a).
The third and most infamous count belonged to Kurtaj alone, the 17-year-old not having been charged in relation to the Rockstar attack. While confined to a Travelodge in Bicester under bail conditions banning internet use, Kurtaj used an Amazon Fire Stick, a newly purchased smartphone, a keyboard and a mouse to attack Revolut, Uber and finally Rockstar Games (BBC News, 2023a). The Rockstar breach culminated in a Slack message posted to every Rockstar employee declaring "I am not a Rockstar employee, I am an attacker", together with a threat that "if Rockstar does not contact me on Telegram within 24 hours I will start releasing the source code" for GTA 6 (BBC News, 2023a; Tobin, 2023). Ninety video clips of unfinished gameplay were posted under the username "TeaPotUberHacker" on GTAForums, an act prosecutors described as Kurtaj's "most audacious" hack and which constituted the unwarranted demand with menaces underpinning the third blackmail count (BBC News, 2023a).
After a seven-week trial, the jury — instructed under the special procedure for defendants found unfit to plead — determined that Kurtaj had done the acts alleged on all twelve offences he faced, comprising three counts of blackmail, two counts of fraud and six Computer Misuse Act charges (Tobin, 2023; BBC News, 2023a). The 17-year-old was convicted on his two blackmail counts plus the Nvidia and BT-related computer offences he had contested, in addition to earlier guilty pleas (Tobin, 2023). Kurtaj was subsequently ordered to remain indefinitely in a secure psychiatric facility in December 2023 (Wikipedia, 2026). The three blackmail counts thus mapped the arc of the Lapsus$ extortion enterprise from telecoms ransom, through chip-industry shakedown, to the most consequential video game leak in industry history.
BBC News (2023a) Lapsus$: Court finds teenagers carried out hacking spree. 23 August. Available at: https://www.bbc.com/news/technology-66549159 (Accessed: 14 May 2026).
Goodin, D. (2023) 'How fame-seeking teenagers hacked some of the world's biggest targets', Ars Technica, 10 August. Available at: https://arstechnica.com/security/2023/08/homeland-security-details-how-teen-hackers-breached-some-of-the-biggest-targets/ (Accessed: 14 May 2026).
Tobin, S. (2023) 'Teen hacked Uber, Revolut and Grand Theft Auto maker, London court hears', Reuters, 11 July. Available at: https://www.reuters.com/technology/teen-hacked-uber-revolut-grand-theft-auto-maker-london-court-hears-2023-07-11/ (Accessed: 14 May 2026).
Wikipedia (2026) Lapsus$. Available at: https://en.wikipedia.org/wiki/Lapsus%24 (Accessed: 14 May 2026).