During proceedings at a London court, prosecutors disclosed that a member of the hacking group Lapsus$, who is a teenager, successfully breached the security systems of Uber and fintech company Revolut.
The individual in question, identified as Arion Kurtaj, allegedly gained unauthorised access to the personal information of approximately 5,000 Revolut customers in September 2022, while also inflicting damages amounting to nearly $3 million on Uber.
Furthermore, the prosecution claims that Kurtaj proceeded to target Rockstar Games shortly after, hacking into their systems. In a Slack message addressed to all Rockstar staff, he purportedly threatened to disclose the source code of the highly popular video game franchise, Grand Theft Auto, which was under development for a forthcoming installment.
Additionally, Kurtaj stands accused, alongside an unnamed 17-year-old co-defendant, of engaging in a blackmail scheme against BT Group (BT.L), the largest broadband provider in Britain, and EE, a prominent mobile network operator. This illicit activity reportedly took place between July and November 2021, during which the accused demanded a ransom of $4 million.
Prosecutors assert that the duo, considered “key players” within Lapsus$, conducted a cyberattack on chipmaker Nvidia Corp (NVDA.O) in February 2022. They allegedly sought payment from Nvidia to prevent the public release of the company’s data.
During the trial, prosecutor Kevin Barry revealed that the 17-year-old defendant had breached the cloud storage of the City of London Police, mere weeks after being apprehended in connection with the BT and EE hacking incident.
According to Barry, Kurtaj later embarked on a solo cybercrime spree, commencing with the targeting of Revolut and subsequently Uber, followed by the intrusion into Rockstar Games’ systems.
Kurtaj’s mental fitness to stand trial has been assessed by psychiatrists and found inadequate. Consequently, the jury will evaluate whether he committed the alleged acts, rather than delivering a traditional guilty or not guilty verdict.
The charges leveled against Kurtaj encompass a total of 12 offenses, including three counts of blackmail, two counts of fraud, and six charges under the Computer Misuse Act.
Meanwhile, the 17-year-old defendant is currently being tried for two counts of blackmail, two counts of fraud, and three charges under the Computer Misuse Act related to the hacking of BT and Nvidia. The defendant denies these charges but has previously pleaded guilty to two offenses under the Computer Misuse Act and one count of fraud.
