In December 2023, Southwark Crown Court in London delivered one of the most unusual rulings in modern cybercrime history when it determined that 18-year-old Arion Kurtaj, the central figure behind the September 2022 Grand Theft Auto VI leak, was unfit to stand trial. The ruling was made on the basis of his severe autism, with medical professionals concluding that he could not engage meaningfully with criminal proceedings or follow trial process in the conventional sense (BBC News, 2023). Rather than a standard criminal trial, the court conducted a "trial of facts" under section 4A of the Criminal Procedure (Insanity) Act 1964, in which the jury was asked solely to determine whether Kurtaj had committed the alleged acts — not whether he had done so with criminal intent (The Guardian, 2023).
Kurtaj, originally from Oxford, was a core member of the international hacking collective Lapsus$, a loosely organised group of mostly teenage actors responsible for high-profile breaches of Microsoft, Nvidia, Uber, BT/EE, Revolut and Rockstar Games during 2021 and 2022 (BBC News, 2023). At the time of the Rockstar Games attack, Kurtaj was already on police bail for the Nvidia and BT/EE intrusions and was being held under police protection at a Travelodge hotel. Despite having his laptop confiscated, he carried out the now-infamous Rockstar Games breach using only an Amazon Firestick, the hotel television and a mobile phone, exfiltrating 90 in-development clips of GTA VI and portions of the source code (The Guardian, 2023).
During pre-trial assessments, doctors conducted detailed psychiatric evaluations and concluded that Kurtaj's autism spectrum disorder was sufficiently severe that he could not participate in his own defence in the manner required by English criminal procedure. The court also heard that Kurtaj had been repeatedly violent while in custody, with dozens of recorded incidents of injury or property damage (BBC News, 2023).
Because Kurtaj was deemed unfit to plead, the six-week proceeding at Southwark Crown Court did not produce a conventional guilty verdict. Instead, jurors were instructed to decide only whether the prosecution had proved that Kurtaj performed the alleged acts (Sportskeeda, 2023). The jury found that he had. Her Honour Judge Patricia Lees subsequently imposed an indefinite hospital order under the Mental Health Act 1983, meaning Kurtaj will remain detained in a secure hospital until clinicians and the relevant authorities determine he is no longer a danger to the public (Futurism, 2023).
A mental health assessment cited during sentencing stated that Kurtaj "continued to express the intent to return to cyber-crime as soon as possible" and that "he is highly motivated" — a key factor cited by the judge in concluding that he remained a high risk to the public (BBC News, 2023). The defence's argument that the eventual successful release of the GTA VI trailer (which drew 128 million views in four days) demonstrated minimal lasting harm was rejected; the judge emphasised the real-world damage to Rockstar Games (USD 5 million in recovery costs plus thousands of staff hours) and the wider victims of the Lapsus$ campaign, totalling roughly USD 10 million in damages across multiple companies (The Guardian, 2023).
The Kurtaj ruling occupies a distinctive place in cyber-law jurisprudence. It is rare for a defendant in a high-profile cybercrime case to be found unfit to plead, and rarer still for the disposal to be an indefinite hospital order rather than a custodial sentence. The case has sparked debate among legal commentators on three fronts: (1) the appropriateness of indefinite hospital orders for cognitively impaired but technically gifted offenders; (2) the safeguarding implications for autistic young people drawn into online criminal subcultures; and (3) the procedural challenges of trying digitally sophisticated defendants whose communication needs do not align with standard courtroom processes (Neowin, 2023; Sportskeeda, 2023).
The ruling also prompted the City of London Police to issue a public warning aimed at parents about monitoring children's online activity, with DCS Amanda Horsburgh noting that the digital world can be "tempting to young people for the wrong reasons" (The Guardian, 2023).
For Grand Theft Auto VI specifically, the ruling brought formal legal closure to the most damaging pre-release leak in the franchise's history. Rockstar Games and parent company Take-Two Interactive were left to manage the reputational and operational fallout while production continued. The court's recognition that Kurtaj was unfit to stand trial — combined with the indefinite hospital order — meant that the perpetrator of the leak would be removed from the cybercrime ecosystem for the foreseeable future, but it did not resolve the broader question of how easily teenage actors had been able to penetrate one of the world's most valuable entertainment IPs.
BBC News (2023) Lapsus$: GTA 6 hacker handed indefinite hospital order. Available at: https://www.bbc.com/news/technology-67663128 (Accessed: 14 May 2026).
Futurism (2023) GTA 6 Hacker Committed to Hospital Indefinitely After Vowing to Return to Cybercrime. Available at: https://futurism.com/the-byte/gta-6-hacker-hospital (Accessed: 14 May 2026).
Neowin (2023) The GTA 6 hacker has been sentenced to stay in a secure hospital indefinitely. Available at: https://www.neowin.net/news/the-gta-6-hacker-has-been-sentenced-to-stay-in-a-secure-hospital-indefinitely/ (Accessed: 14 May 2026).
Sportskeeda (2023) GTA 6 hacker's hospital prison sentence explained. Available at: https://www.sportskeeda.com/gta/gta-6-hacker-s-hospital-prison-sentence-explained (Accessed: 14 May 2026).
The Guardian (2023) British teenager behind GTA 6 hack receives indefinite hospital order. Available at: https://www.theguardian.com/uk-news/2023/dec/21/british-teenager-behind-gta-6-hack-receives-indefinite-hospital-order (Accessed: 14 May 2026).