The Wall Street Journal explores the backstory of Arion Kurtaj, the infamous teen behind the Grand Theft Auto VI leak. Now 19 years old, Kurtaj has become a prominent figure in a vast network of online communities known as the Com. Law enforcement officials and cybersecurity experts warn that these groups are particularly dangerous due to the youthful creativity and determination of their members, alongside their status as minors, which complicates prosecution. Many of these young individuals are recruited from popular online platforms like Minecraft and Roblox.

William McKeen, a supervisory special agent with the FBI’s Cyber Division, notes that the average age of individuals arrested for crimes in the U.S. is 37, while for cybercrimes, it drops to just 19. Investigators have uncovered posts suggesting that Kurtaj was involved in online attacks as early as 11 years old. Records indicate that he struggled with social skills and forming relationships, leading him to seek validation in the thriving realm of cybercrime.

At 14, Kurtaj was placed in a residential school catering to children with severe emotional and behavioral issues. He was later physically assaulted by a staff member, who faced legal consequences for the incident. By early 2021, Kurtaj’s mother removed him from government care, and he never returned to school, dropping out at 16. Just a month after leaving school, he allegedly became a member of the hacking group Recursion Team, which breached the video game company Electronic Arts and stole 780 gigabytes of data. When Electronic Arts chose not to engage, the hackers publicly leaked the stolen information. Within a week of the breach, investigators identified Kurtaj and referred his name to the FBI.

In the summer of 2021, court records reveal that Kurtaj teamed up with another teenager known as ASyntax and several Brazilian hackers to form a group called Lapsus$. They targeted British telecommunications giant BT, attempting to steal money through a method known as SIM swapping. However, their hacks were not always financially motivated. In late 2021, Lapsus$ infiltrated a website run by Brazil’s Ministry of Health, deleting the country’s Covid vaccination database, as reported by law enforcement.

If the Com has a central hub, it is the website Doxbin, where users share personal information, such as home addresses and phone numbers, of their online rivals to intimidate one another. In November 2021, Kurtaj purchased Doxbin for $75,000, according to Chainalysis. However, after a few months, the previous owners claimed he mismanaged the site and pressured him to sell it back, which he eventually did. In January 2022, cybersecurity investigators allege that he doxxed the entire site, releasing a database containing usernames, passwords, and email addresses he had downloaded while owning it. This information proved invaluable for investigators trying to connect various cybercrimes to their perpetrators, according to Allison Nixon, chief research officer at Unit 221B, an online investigations firm.

Doxbin’s previous owners retaliated by doxxing Kurtaj and his family, revealing their home address and photos, which set off a chain of events that led to Kurtaj’s stay in a Travelodge. After two weeks in “protective custody,” during which he was meant to be without computer access, Kurtaj was arrested for a third time on charges of hacking, fraud, and blackmail. Authorities reported that while staying at the Travelodge, he hacked into Uber, mocking the company by posting a provocative link on their internal Slack messaging system, and also stole software and videos from Rockstar Games. Stolen clips began circulating on a Grand Theft Auto discussion forum under the username teapotuberhacker, igniting a frenzy among fans. “As officers gathered evidence, the teen reportedly stood by, emotionless,” police stated.

Kurtaj’s lawyers, along with some autism experts, argue that a potential lifetime sentence is unjust for a teenager like him. Thanks to longtime Slashdot reader SpzToid for sharing the article.

s3a s3a s3a s3a s3a s3a s3a s3a s3a s3a s3a s3a s3a s3a s3a s3a s3a s3a s3a s3a