The GTA 6 Leaker: Arrest, Verdict, Sentence — and a 2026 Retrial
Four days after the leak, police arrested a 17-year-old in Oxfordshire. The case that followed produced an indefinite hospital order — and it is still not finished.
The 2022 leak has an ending, and it is stranger than the leak. It is also not quite over.
On September 22, 2022, four days after the files appeared, City of London Police arrested a 17-year-old in Oxfordshire on suspicion of hacking, working with the National Crime Agency's National Cyber Crime Unit. The police statement named neither Rockstar nor Uber; the connection was reported rather than officially confirmed at the time. He faced two counts of computer misuse and — the detail that shaped everything after — two counts of breaching bail conditions. He was already on bail for earlier offences when the Rockstar intrusion took place.
In August 2023 at Southwark Crown Court, Arion Kurtaj, by then 18, was found by a jury to have committed twelve offences spanning computer intrusion, blackmail and fraud. Because psychiatrists assessed Kurtaj, who is autistic, as unfit to stand trial, the jury was asked only whether he did the acts, not whether he was guilty of them. That distinction matters and is frequently reported wrongly.
The method became the detail everyone remembers. Kurtaj carried out the Rockstar intrusion while under police protection in a hotel, after his laptop had been seized, using an Amazon Fire Stick, the hotel room television, a phone, a keyboard and a mouse. The wider Lapsus$ campaign he was tied to had already reached Nvidia, BT/EE, Uber, Microsoft, Samsung, Vodafone, Revolut and Okta.
At sentencing on December 21, 2023, the judge found Kurtaj a high risk to the public and "highly motivated to return to cyber-crime as soon as possible," and imposed an indefinite hospital order — detention in a secure hospital with no fixed end date, reviewable only if doctors judge he is no longer dangerous. It is not a prison sentence; it follows from the unfitness finding. A 17-year-old co-defendant who cannot be named received an 18-month Youth Rehabilitation Order.
Rockstar told the court the breach cost roughly $5 million to recover from, plus thousands of hours of staff time. A figure of £7 million also circulates widely in coverage; the two are reported inconsistently and we assert neither as settled.
And the case continues. Kurtaj has since been moved out of the secure hospital and, as reported this month, is awaiting a retrial listed for November 2026 — the same month Grand Theft Auto VI is due to ship.