A UK court finds 18-year-old Arion Kurtaj and a 17-year-old were part of Lapsus$, the group that hacked Uber, Nvidia, and Rockstar Games in 2021 and 2022
A court has found an 18-year-old from Oxford was a part of an international cyber-crime gang responsible for a hacking spree against major tech firms
Context & Ripple Effects
The finding advances a case that began with UK police arrests tied to a hacking-group investigation and later focused on a teenager charged after the Uber and Rockstar incidents.
It turns allegations that two teenagers were central to Lapsus$ into a court finding, tying one group’s campaign to several prominent technology and gaming companies.
First-order effects
- Kurtaj and the other teenager are now judicially identified as members of Lapsus$, strengthening the legal record around the intrusions affecting Uber, Nvidia, and Rockstar Games.
- The affected companies gain a clearer attribution outcome after attacks that exposed how quickly a small group could disrupt high-profile businesses.
Second-order effects
- The case gives UK authorities a more concrete basis for pursuing related participants and examining the group’s methods and alleged associates.
- For targeted companies and peers, the outcome reinforces the need to treat social-engineering and account-access risks as material operational threats, not only conventional malware incidents.
Third-order effects
- If similar cases continue, cybercrime enforcement will increasingly confront the mismatch between globally consequential intrusions and juvenile justice processes involving young alleged offenders.
- The episode points to a persistent security challenge: a small, loosely organized set of attackers can create cross-sector exposure for technology platforms, chipmakers, and game publishers.
The trend: High-impact cyber incidents are increasingly being traced to small, digitally native groups whose attacks cut across multiple major technology sectors.