On September 18, 2022, the most anticipated game in history leaked: over 90 videos of unreleased GTA 6 footage dumped onto a fan forum for the world to dissect. The person behind the biggest breach in gaming history was an 18-year-old from Oxford: on bail, under police protection, laptop confiscated. He pulled it off from a budget hotel room using an Amazon Fire TV Stick plugged into the television.
Key Takeaways
- September 18, 2022: over 90 GTA 6 development videos leaked online, the biggest breach in gaming history.
- The tool was an Amazon Fire TV Stick plugged into a Travelodge hotel TV, used while Kurtaj was on bail with his laptop confiscated.
- Lapsus$ tore through Nvidia, Samsung, Microsoft, Okta, and Uber in under a year using bribes, SIM swaps, and phishing, not advanced malware.
- Rockstar put its recovery costs above $5 million.
- The group openly offered telecom insiders up to $20,000 a week for access to internal systems.
- December 2023: Kurtaj was ordered detained in a secure hospital indefinitely after a jury found him responsible on all 12 counts.
Who Is Arion Kurtaj?
Arion Kurtaj is an autistic teenager from Oxford, England, who became one of the most prolific members of the Lapsus$ hacking group, and the person behind the GTA 6 leak. He grew up attending a special needs school; his father once described him simply as “very good on computers.” That undersells it. By 16, Kurtaj was one of the most active members of Lapsus$, a loose, chaotic hacking crew of teenagers from the UK and Brazil who coordinated over Telegram and attacked some of the biggest companies on Earth. Not for ideology, and mostly not even for money. Because they could.
His record reportedly started before the famous hacks: as part of the case against him, prosecutors described a 2021 intrusion into BT’s mobile arm EE, accompanied by a $4 million ransom demand that was never paid.
Lapsus$ didn’t rely on movie-grade malware. Their playbook was people, and it fit on an index card:
- SIM swapping: hijack a target’s phone number to intercept two-factor login codes.
- MFA fatigue: bombard an employee with authentication prompts until they tap “approve” just to make it stop.
- Insider recruitment: openly offer employees at AT&T, Verizon, and T-Mobile up to $20,000 a week for inside access.
- Plain phishing: emails and messages good enough to fool trained staff.
It’s the same insider economy that later powered the Coinbase breach, where bribed support agents leaked customer data.
The Rampage Before Rockstar
Between late 2021 and September 2022, Lapsus$ tore through a who’s who of global tech.
| Date | Target | What happened |
|---|---|---|
| February 2022 | Nvidia | Claimed a terabyte-scale haul including credentials for 71,000 employees; demanded open-source drivers and the removal of crypto-mining limits |
| March 2022 | Samsung | Leaked gigabytes of internal source code |
| March 2022 | Microsoft, Okta | Dumped source code; FBI issued a public appeal |
| 2022 | Uber, Ubisoft, Vodafone, Revolut | Breached in quick succession |
| September 18, 2022 | Rockstar Games | 90+ GTA 6 videos leaked from a hotel room |
The US Department of Homeland Security later published a full review of Lapsus$ and reached an unflattering conclusion: the group used low-cost techniques that were well known and available to anyone. Nothing revolutionary: they simply understood that the weakest point of any security system is the person sitting in front of the computer.
City of London Police arrested seven teenagers in March 2022 in connection with Lapsus$, Kurtaj among them, aged 16. He was released on bail. Then rival hackers doxxed him: address, family details, everything. Police moved him to a Travelodge in Bicester for his own safety. His bail conditions: no internet. His laptop was seized. He was supposed to sit and wait for trial.
How Did Kurtaj Hack Rockstar From a Hotel Room?
Kurtaj hacked Rockstar by plugging an Amazon Fire TV Stick into his hotel room television, connecting it to the Travelodge Wi-Fi, and using it as a bridge to cloud computing services, and from there into Rockstar’s internal Slack and development files. Police had taken his laptop. They didn’t take his phone, and they didn’t think about a streaming stick. Armed with a smartphone, a keyboard, and a mouse, he broke into the most secretive company in gaming and announced himself to its employees.
The Travelodge weeks were prolific even before Rockstar. In mid-September 2022, days before the GTA 6 leak, Uber suffered a breach it publicly attributed to Lapsus$. The intrusion plastered messages across its internal systems and, prosecutors later said, cost the company roughly $3 million to clean up.
“If Rockstar does not contact me on Telegram within 24 hours, I will start releasing the source code.” (message posted to Rockstar’s internal Slack)
Rockstar didn’t respond in time. Under the username teapotuberhacker, Kurtaj posted more than 90 development videos: early gameplay, debug menus, the map, and a female protagonist not yet confirmed publicly. Within hours it was everywhere. Rockstar, a company that builds hype through total secrecy, confirmed the breach, saying it was “extremely disappointed,” and later put recovery costs above $5 million. The real loss was control: a $2 billion-plus project’s first reveal was written by a teenager in a Travelodge. When police searched the room, everything was still connected and active. This time, there was no bail.
A Trial Unlike Any Other
Psychiatrists determined Kurtaj was unfit to stand trial in the traditional sense, so the jury was asked only whether he committed the acts, not whether he intended them. In August 2023, they found him responsible on all 12 counts. The court heard he had been violent in custody and had told medical staff he intended to return to cybercrime as soon as possible. In December 2023, the judge ordered him detained in a secure hospital indefinitely, until doctors decide he no longer poses a risk to the public. A 17-year-old co-defendant, unnamed due to his age, received an 18-month youth rehabilitation order.
The sentence sits at the hard end of teen-hacker justice. Graham Ivan Clark, the 17-year-old behind the 2020 Twitter hack that hijacked the accounts of Obama and Musk, took a plea deal for three years. Kurtaj, judged a continuing danger rather than merely a criminal, got no end date at all. In a final twist of timing, Rockstar released GTA 6’s first official trailer in early December 2023, the same month Kurtaj was sentenced; it broke YouTube records within 24 hours.
The DHS Cyber Safety Review Board’s August 2023 post-mortem pointedly declined to marvel at the hackers. It blamed the companies, urging an end to SMS-based two-factor authentication, better social engineering defenses, and real insider-threat programs. The uncomfortable lesson of the entire Lapsus$ spree, filed alongside the rest of our hacking investigations: billion-dollar security budgets keep losing to a kid with a phone and a convincing story.
The Critical Choice
Every step of this story funnels through one decision made in a Travelodge in Bicester. Kurtaj was on bail, doxxed, protected, and one court date away from a future that could still have been salvaged. The state had made its own error, confiscating a laptop while leaving a phone and a streaming stick. But the choice was his: sit tight, or use a £40 gadget to break into the most secretive company in gaming. He chose the hack, and in doing so converted a teenage criminal case into an indefinite detention. The companies chose poorly too, for years. But it was that one choice, made while already under police watch, that made the ending inevitable.
Where Things Stand Now
Arion Kurtaj remains detained in a secure hospital, and given his stated intent to reoffend, he may be there for many years. Lapsus$ has gone silent since September 2022, but its scene didn’t retire: the same English-speaking social-engineering underground produced Scattered Spider, the crew behind the 2023 MGM casino hack, and its techniques (SIM swapping, social engineering, paying insiders) are now standard practice for criminal groups every single day. GTA 6 launches on November 19, 2026: four years after a teenager in a budget hotel showed the world what it looked like before Rockstar was ready.
