Two teenagers, Arion Kurtaj and an unnamed 17-year-old, are facing accusations from British prosecutors for their involvement in a series of high-profile hacks as part of the now-inactive Lapsus$ hacking group. The duo hacked into companies such as Revolut, Uber, and Rockstar, resulting in the exposure of personal data from thousands of Revolut users and the leaking of unreleased game footage from Rockstar.
The teenagers also targeted Microsoft, Nvidia Corp., and Okta in previous incidents. Identified through their IP addresses, the hackers now face charges including blackmail, fraud, and violations of the Computer Misuse Act.
During the court hearing, British prosecutor Kevin Barry emphasized that Arion Kurtaj and the unidentified 17-year-old played crucial roles within the Lapsus$ group. Kurtaj was accused of hacking into Revolut and Uber, as well as threatening to leak the Rockstar game.
The unnamed teenager, while out on bail, also hacked into London police servers. In another incident, the duo targeted Nvidia Corp., stealing nearly 1 terabyte of sensitive data, including source code, which they threatened to release in exchange for a ransom.
Prosecutors also revealed that the teenagers conducted cryptocurrency scams using fraudulent SIM cards and targeted the British broadband service EE network. Their online bragging and activities led to their identification based on their IP addresses.
Arion Kurtaj has been charged with multiple offenses, including blackmail, fraud, and violations of the Computer Misuse Act. While Kurtaj was assessed as unfit to stand trial by a psychiatrist, the jury will decide on his culpability. The unidentified 17-year-old suspect has already been found guilty on seven charges related to blackmail, fraud, and Computer Misuse Act violations.
Formed in 2019, Lapsus$ operated mainly through a Telegram account. However, the group has been inactive following the arrests of several members in London and Brazil.
