On 21 December 2023, Southwark Crown Court in London handed down one of the most unusual sentences in the history of cybercrime prosecutions: an indefinite hospital order imposed on Arion Kurtaj, the 18-year-old hacker chiefly responsible for the September 2022 breach of Rockstar Games and the leak of approximately 90 in-development videos of Grand Theft Auto VI. Rather than a custodial prison sentence, Mrs Justice Lucraft KC ordered that Kurtaj be detained indefinitely in a secure psychiatric hospital under provisions of the Mental Health Act 1983, citing his diagnosis of acute autism, his demonstrable lack of remorse, and his expressed intention to return to cybercrime at the earliest opportunity (BBC News, 2023). The judgement formally closed the criminal proceedings against the two convicted UK members of the Lapsus$ extortion gang and became the definitive legal coda to the GTA VI leak saga.
Kurtaj, of Oxford, was a founding member of the international hacker collective Lapsus$, which between 2021 and 2022 conducted high-profile intrusions against Nvidia, Samsung, Microsoft, Okta, Uber and Rockstar Games (Wikipedia, 2026). After being arrested in March 2022 and released on bail, Kurtaj — while staying in a Travelodge hotel under police supervision because his home address had been doxxed — used an Amazon Fire TV stick, a hotel television and a mobile phone to breach Rockstar Games' internal Slack and Confluence environments on 16–18 September 2022 (Tidy, 2023). He exfiltrated 90 clips of pre-release GTA VI footage and posted them to GTAForums under the handle "teapotuberhacker", precipitating the largest leak in video game history.
A seven-week jury trial at Southwark Crown Court concluded on 23 August 2023, when Kurtaj was found to have carried out offences including blackmail, fraud and breaches of the Computer Misuse Act 1990. Because psychiatric assessments deemed him unfit to plead, the jury was asked only to determine whether he had committed the acts rather than whether he was criminally culpable in the conventional sense (BBC News, 2023a). Sentencing was deferred to December pending further psychiatric evaluation.
At the sentencing hearing on 21 December 2023, the court heard that Kurtaj remained "highly motivated" to re-offend, that he had been violent on more than 40 occasions while held at Broadmoor-style secure accommodation, and that clinicians considered his risk to the public to be high given his exceptional technical skill (Tidy, 2023). The prosecution highlighted that the Lapsus$ campaign had cost Rockstar's parent company Take-Two Interactive an estimated US$5 million in direct response costs and consumed thousands of staff-hours, while total damages across all Lapsus$ victims approached US$10 million (Entrepreneur, 2023).
Mrs Justice Lucraft KC concluded that a determinate prison term was inappropriate and instead imposed a hospital order with restrictions under sections 37 and 41 of the Mental Health Act 1983. Under this disposal Kurtaj will remain in a secure hospital until clinicians and the Ministry of Justice jointly conclude that he no longer presents a danger — a condition that, given his stated intent, may never be satisfied. A co-defendant, a 17-year-old whose identity remains protected, was sentenced separately to a youth rehabilitation order (BBC News, 2023).
Commentators noted that the judgement marked a notable precedent in UK cyber-sentencing, treating advanced hacking capability itself as a continuing public-safety risk warranting indefinite clinical detention (Game Rant, 2023). Coincidentally, on 25 December 2023 — only four days after the sentencing — fresh material from the original 2022 Rockstar breach surfaced online, including alleged GTA V source code and Python scripts from GTA VI, underlining the long tail of the original intrusion even after its perpetrator had been institutionalised (Wikipedia, 2026).
The disposition also drew comment from autism-advocacy groups, who cautioned against conflating neurodivergence with criminality, while cybersecurity researchers framed the outcome as a reminder of the youth and vulnerability characterising contemporary extortion crews such as Lapsus$, Scattered Spider and ShinyHunters.
BBC News (2023) Lapsus$: GTA 6 hacker handed indefinite hospital order. 21 December. Available at: https://www.bbc.co.uk/news/technology-67663128 (Accessed: 14 May 2026).
BBC News (2023a) Lapsus$: Court finds teenagers carried out hacking spree. 23 August. Available at: https://www.bbc.co.uk/news/technology-66549159 (Accessed: 14 May 2026).
Entrepreneur (2023) Hacker Who Leaked GTA 6 Sentenced to Life in Psychiatric Hospital. Available at: https://www.entrepreneur.com/business-news/gta-hacker-gets-life-sentence-for-stealing-10-million-data/467628 (Accessed: 14 May 2026).
Game Rant (2023) GTA 6 Hacker Gets 'Indefinite Hospital Order'. Available at: https://gamerant.com/gta-6-hacker-indefinite-hospital-order/ (Accessed: 14 May 2026).
Tidy, J. (2023) 'GTA 6 hacker handed indefinite hospital order', BBC News, 21 December.
Tobin, S. (2023) 'Teen hacked Uber, Revolut and Grand Theft Auto maker, London court hears', Reuters, 11 July. Available at: https://www.reuters.com/technology/teen-hacked-uber-revolut-grand-theft-auto-maker-london-court-hears-2023-07-11/ (Accessed: 14 May 2026).
Wikipedia (2026) Lapsus$. Available at: https://en.wikipedia.org/wiki/Lapsus%24 (Accessed: 14 May 2026).