UK police arrest seven people aged 16 to 21 as part of an investigation “into a hacking group”, but did not say if the teenager behind Lapsus$ is among them

A 16-year-old from Oxford has been accused of being one of the leaders of cyber-crime gang Lapsus$.

BBC 2022-03-25

Context & Ripple Effects

The Oxford teenager was identified in coverage as an alleged Lapsus$ leader, placing the police action within a case focused on a youth-linked cybercrime group. Within a week, the inquiry had progressed to charges against a 16-year-old and a 17-year-old, indicating that investigators were moving from detention toward specific allegations.

Later prosecutor accusations that two teenagers were key Lapsus$ members connected the case to intrusions affecting Nvidia, Rockstar, and Uber, giving the arrests significance beyond a single local investigation.

First-order effects

UK police can hold and investigate the seven people arrested, while the alleged Lapsus$ leadership is subjected to direct law-enforcement scrutiny.
The case quickly narrowed into formal allegations against two teenagers, as reflected in the subsequent charges tied to Lapsus$.

Second-order effects

A prosecution centered on alleged teenage participants makes attribution and evidence preservation more consequential for organizations targeted by Lapsus$, including the companies later named by prosecutors.
UK investigators shift the practical response to youth-led intrusion groups from broad arrests toward chargeable individual conduct, rather than treating the group only as an anonymous online actor.

Third-order effects

The Lapsus$ case points to cybercrime enforcement increasingly confronting loosely organized, youth-linked groups through individual criminal cases—a model whose reach depends on investigators being able to connect online activity to specific people.

The trend: Cybercrime enforcement is increasingly translating high-profile group intrusions into individual cases, with identity attribution becoming the central bottleneck.

Discussion

@malwaretechblog Marcus Hutchins on x
How to tell if your child is hacking Microsoft https://twitter.com/...
@kevincollier Kevin Collier on x
The most interesting thing about Lapsus$, or that Twitter hack last year, is it's proof yet again that the hundreds-of-billion-of-dollars cybersecurity industry is often foiled by rambunctious teens. https://www.vice.com/...
@caseynewton Casey Newton on x
There are only two kinds of internet teens today: the ones who look at TikTok too much and feel sad, and the ones who form hacking gangs and make millions of dollars infiltrating Microsoft https://www.bbc.com/...
@malwarejake Jake Williams on x
“Seven people between the ages of 16 and 21 have been arrested in connection with this investigation and have all been released under investigation” - a bit different to hear they've been released, but still glad to see movement this fast. #Okta https://www.reuters.com/...
@seldo Laurie Voss on x
Okay obviously being a 16-year-old superhacker who has pulled off multiple world-famous hacks is *BAD* but also I think we can agree this guy is cool as hell https://www.bloomberg.com/...
@tomwarren Tom Warren on x
it looks like British teenagers were behind the LAPSUS$ hacking group that's breached Nvidia, Microsoft, Okta, and others. Reminds me a lot of LulzSec, which was also full of British teenagers who attacked PSN https://www.theverge.com/... https://twitter.com/...
@viss @viss on x
oh wow, so one of the lapsus kids was involved in the EA hack? https://krebsonsecurity.com/ ...
@kevincollier Kevin Collier on x
BBC's reporting says that arrested London youngin hackers is indeed Lapsus$, and it would be shocking if it was for a separate group, for fwiw London police are pointedly not saying it's them, at least so far. Their full statement: https://www.bbc.com/... https://twitter.com/...
@nicolebeckwith @nicolebeckwith on x
There's a lot to unpack here. Supposed LAPSUS$ arrests, millions in profit, law enforcement knew, parent comments... this is a must read. https://www.bbc.com/...
@paulvixie Paul Vixie on x
<<The boy's father told the BBC his family was concerned and was trying to keep him away from his computers.>> isn't it always the way? https://www.bbc.com/...
@kantrowitz Alex Kantrowitz on x
“A woman who identified herself as the boy's mother talked with a Bloomberg reporter for about 10 minutes through a doorbell intercom system.” Amazing. https://www.bloomberg.com/...
@joetidy Joe Tidy on x
City of London police told my colleague @radioproducer : “7 people between the ages of 16 and 21 have been arrested in connection with an investigation into the hacking group. They have all been released under investigation. Our inquiries remain ongoing.”
@joetidy Joe Tidy on x
The teenager has been outed by rival hackers after a dispute. But, as reported by Bloomberg, researchers have been tracking him for nearly a year. His dad told me: “he is very good on computers and spends a lot of time on the them. I always thought he was playing games.”
@nixonnixoff Allison Nixon on x
Please try MUCH harder https://twitter.com/...
@jeffstone500 @jeffstone500 on x
Said better: Lapsus$ appears to be a gang of SIM-swapping kids, compared to more organized Russian criminal gangs. So, there's a lot of nuance here.
@gregotto Greg Otto on x
City of London Police said 7 people between the ages of 16 and 21 have been arrested in connection with an investigation into LAPSUS$ https://www.bbc.com/...
@jeffstone500 @jeffstone500 on x
More typical Russian gangs like Conti, last longer, spending up to a year at a time extorting victims before they shut down, change or self-destruct. I don't have a point, really. This is just a crazy story that feels like a shift in crime tactics. https://www.bloomberg.com/...
@jeffstone500 @jeffstone500 on x
That's all in ~4 months. Compared to a gang like The Dark Overlord, which hacked Netflix in 2017. Then...crickets, in terms of investigations. Group emerged again in 2019, followed by some convictions in 2020, all while victims kept adding up. https://www.cyberscoop.com/...
@nixonnixoff Allison Nixon on x
“The boy's father told the BBC his family was concerned and was trying to keep him away from his computers.” try harder omg https://www.bbc.com/...
@jeffstone500 Jeff Stone on x
Lapsus$ case is moving....fast. They just emerged a few months ago, hacked a bunch of big victims, @WilliamTurton @jordanr1000 report that a 16-year-old is suspected mastermind, confirmed by @briankrebs Now @BBCNews reports that seven are in custody. https://www.bbc.com/...
@williamturton William Turton on x
WOW: City of London Police said: “Seven people between the ages of 16 and 21 have been arrested in connection with an investigation into a hacking group. They have all been released under investigation. Our inquiries remain ongoing.” That was fast. https://twitter.com/...

Chronicles