The Rockstar Hack in Court: Lapsus$ Member Arion Kurtaj Given an Indefinite Hospital Order at Southwark Crown Court

Confirmed — the jury’s findings and the order are set out in the Court of Appeal’s own judgment, Arion Kurtaj v R [2025] EWCA Crim 1163, and the sentencing was reported from court. This story covers the case only. We do not describe or link anything taken in the September 2022 breach.

The trial: Kurtaj, then 18, was tried at Southwark Crown Court in London before HH Judge Patricia Lees in the summer of 2023. Psychiatrists had found him unfit to plead, so the jury was asked only whether he did the acts, not whether he was guilty. On August 23, 2023 it found he had, on all 12 counts, which included blackmail, fraud and Computer Misuse Act offences. Rockstar Games was among the companies named. A younger co-defendant was convicted in the same trial.

The sentence: on December 21, 2023 the judge made a hospital order under section 37 of the Mental Health Act 1983, with a section 41 restriction order: detention in a secure hospital with no fixed end date. She said he remained “determined to commit further serious offences if the opportunity arose” (The Record).

The appeal: on September 11, 2025 the Court of Appeal dismissed his appeal against the jury’s findings.

The limit of this story: the case may not be over. On July 14, 2026 BBC cyber correspondent Joe Tidy reported that Kurtaj had left the secure hospital, was in prison awaiting retrial, and would face a conventional criminal trial in November. We have not seen a court listing for that, so that part is Reported, not Confirmed.