Teen Hacker Behind GTA VI Leak Sentenced to Indefinite Hospital Detention

An 18-year-old British hacker, Arian Kurtaj, has been sentenced to indefinite hospital detention after leaking early Grand Theft Auto VI footage in 2022.

Back in September 2022, Kurtaj — linked to the ransomware group Lapsus$ — managed to breach Rockstar Games’ servers. The hack revealed major details about GTA VI, including its Vice City setting and the introduction of dual protagonists, Julia and Jason. For fans, it was the first real glimpse into one of the most anticipated games of the decade. But for Rockstar, it was a nightmare that disrupted years of carefully guarded development.

Kurtaj’s actions landed him in a secure hospital facility. According to reports by BBC News, the court deemed him an "ongoing public threat" after he openly expressed his desire to continue hacking. His detention will last until medical professionals are confident he no longer poses a risk.

The Hack That Rocked Rockstar

Arian Kurtaj’s 2022 breach of Rockstar Games was one of the biggest leaks in gaming history, and here’s what actually came out of it:

• Around 90 in-development gameplay clips from Grand Theft Auto VI were posted online, showing early builds of the game.

• These clips confirmed Vice City as the setting and introduced the two new protagonists, Jason and Lucia.

• The footage also revealed new AI systems, physics improvements, and animations that Rockstar was testing.

• Kurtaj claimed to have stolen the source code for both GTA V and GTA VI, along with other internal assets. While the GTA V source code later surfaced online, it’s still unclear if GTA VI’s source code was fully compromised.

• He accessed 200 GB of additional Rockstar data, though most of that never became public.

Shockingly, Kurtaj pulled this off while under police protection in a hotel. Before the GTA VI breach, Kurtaj had already been out on bail for earlier cyberattacks on Nvidia and BT/EE (a British telecom provider). Because of threats to his safety, he was placed in a hotel under police protection. Authorities had confiscated his laptop, thinking this would prevent further hacking. But Kurtaj was resourceful. He bought a cheap Amazon Fire TV Stick, connected it to the hotel TV, and paired it with a new smartphone, keyboard, and mouse.

How He Got In

The Fire TV Stick runs a stripped‑down version of Android. Kurtaj sideloaded apps and used it as a makeshift computer. With the hotel’s Wi‑Fi, he could access the internet freely.

Then, he gained access to Rockstar Games’ internal Slack channels, which employees used for communication. According to reports, he used stolen credentials and social engineering tactics to slip into their system

Once inside, he accessed development servers and downloaded around 90 gameplay clips of Grand Theft Auto VI and shared some on the GTA forum.

Then, he demanded $10 million through Telegram to prevent the release of GTA VI’s source code. Authorities arrested him before he could follow through, but the damage was already done. Rockstar reassured players that the game is still on track for its planned 2025 release [now May 2026], though the breach caused both financial and reputational setbacks.

A Wider Pattern of Cybercrime

Court documents revealed that Kurtaj’s activities weren’t limited to Rockstar. He also targeted major companies like Nvidia, Microsoft, and Uber, with damages estimated at around $10 million. Prosecutors highlighted his lack of remorse and his obsession with hacking, while medical experts testified that his behavior was driven by neurological compulsion rather than deliberate malice.

Why Hospital Detention?

Instead of prison, the court opted for hospital detention. The reasoning was straightforward: public safety and mental health care. Doctors stressed that Kurtaj requires specialized treatment to manage his compulsions, along with strict restrictions on internet access. This approach aims to rehabilitate him rather than simply punish..