Court of Appeal rejects challenge by autistic teen who hacked GTA, Uber and EE

A Court of Appeal panel has dismissed an appeal by a 20-year-old man who hacked technology firms and a video game developer and demanded a multimillion-pound ransom, finding that an error over evidence did not make the case against him unsafe.

Arion Kurtaj, from Oxford, was ordered to be detained indefinitely under a hospital order after proceedings at Southwark Crown Court following a fact-finding hearing. He was declared unfit to plead by psychiatrists who concluded he has severe autism and attention deficit hyperactivity disorder (ADHD). The offences were linked to the Lapsus$ cyber-crime group and included blackmail, fraud, impairing the operation of a computer and refusing to disclose a key.

Kurtaj was accused of stealing 90 video clips and source code relating to Rockstar Games' unreleased Grand Theft Auto VI, and of breaking into the game developer's internal messaging system to threaten the company with publication unless contacted on Telegram. Prosecutors said the group's attacks caused about £7 million in damage to Rockstar. Between July 2021 and February 2022, Kurtaj and an associate, who was then 17, were also linked to intrusions at chip maker NVIDIA, ride-hailing firm Uber, mobile network operator EE, and online bank Revolut.

At the appeal hearing, lawyers for Kurtaj argued that evidence of an earlier guilty plea, entered in March 2021 when he was 15 for hacking into the hosting firm MCProHosting, should not have been admitted at the 2023 proceedings. They said Kurtaj may have been unfit to plead at the time of that earlier plea and that admitting it to the jury was unfair.

A three-judge panel — Lord Justice Holroyde, Lord Justice Edis and Judge Martin Edmunds KC — accepted in a written judgment that the March 2021 convictions "should have been excluded" because no assessment of Kurtaj's capacity to plead had been made then. The judgment said the trial judge's ruling "unintentionally caused unfairness" and that, had further expert evidence been sought in 2021, it "would have risked diverting the jury's attention away from the real issues in the case." The panel said the jury therefore had "no proper basis on which to determine whether the March 2021 guilty pleas were reliable."

Despite that finding, the court concluded the inclusion of the March 2021 evidence did not render the overall findings unsafe. "We are, however, satisfied that the failure to exclude the evidence of the March 2021 convictions does not in itself render unsafe the findings that the applicant did the relevant acts," the judgment said. The judges said the evidence was not central to the prosecution's case and that other material presented amounted to a "very strong case" against Kurtaj.

David Miller, representing Kurtaj, told the appeal court his client may have admitted offences he did not commit because he sought notoriety, a point the panel considered but rejected as insufficient to undermine the factual conclusions. Dharmendra Toor, for the Crown Prosecution Service, said the March 2021 guilty pleas were relevant to demonstrating a propensity to commit hacking offences and that the trial judge was right to admit them.

Kurtaj was detained under an indefinite hospital order at Marlborough House medium-secure hospital in Milton Keynes in December 2023 after the court process. At his sentencing hearing, the court was told he had indicated a desire to return to a life of crime on release, a factor taken into account in the decision to impose a hospital order rather than other disposals.

Rockstar has said the material taken from its systems included unreleased video footage and source code for a title that remains highly anticipated; the company has announced a release window for Grand Theft Auto VI in 2026. The case against Kurtaj formed part of wider law-enforcement scrutiny of Lapsus$-linked intrusions that targeted major technology and entertainment companies in 2021 and 2022.

The Court of Appeal's ruling leaves Kurtaj's hospital order intact. The judgment underscores the court's position that, while procedural errors over admissible evidence were identified, they did not overturn the factual findings that he was responsible for the intrusions and related criminal conduct.

No further appeal was announced immediately after the ruling, and the Crown Prosecution Service said it would not be commenting beyond court submissions. Defense counsel indicated they were considering the written judgment before deciding whether to seek permission to appeal to the Supreme Court.