Teenager Hackers Accused of Blackmailing Uber, Revolut, and Grand Theft Auto Developers
According to prosecutors in a London court, a member of the hacking group Lapsus$, who is a teenager, hacked Uber and fintech firm Revolut and then proceeded to blackmail the developers of the popular video game Grand Theft Auto.
Arion Kurtaj, an 18-year-old, allegedly targeted Revolut and Uber in September 2022, gaining access to the information of approximately 5,000 Revolut customers and causing nearly 3 million USD worth of damage to Uber. Prosecutors claim that he then hacked Rockstar Games a few days later and threatened to release the source code of the planned Grand Theft Auto sequel in a message sent to all Rockstar staff on Slack. Kurtaj is also accused, along with a 17-year-old whose identity is protected, of blackmailing BT Group and EE, two major British companies, between July and November 2021, demanding a ransom of 4 million USD.
The pair, described as "key players" in Lapsus$, are alleged to have hacked chip maker Nvidia Corp in February 2022 and demanded payment to prevent the release of its data. Prosecutors informed the jury at Southwark Crown Court that the 17-year-old hacked the cloud storage of the City of London Police shortly after being arrested in connection with the BT and EE attack.
The prosecutor, Kevin Barry, stated that Kurtaj then went on a solo cyber crime spree, first targeting Revolut and then Uber two days later, before hacking Rockstar Games. Kurtaj has been deemed unfit to stand trial by psychiatrists, so the jury will determine whether he committed the alleged acts instead of delivering a guilty or not guilty verdict. He is facing 12 charges, including three counts of blackmail, two counts of fraud, and six charges under the Computer Misuse Act.
The 17-year-old is also on trial for two counts of blackmail, two counts of fraud, and three charges under the Computer Misuse Act related to the hacking of BT and Nvidia, which he denies. He has previously pleaded guilty to two offenses under the Computer Misuse Act and one count of fraud.
Source: Reuters