Arion Kurtaj, the hacker linked to the Lapsus$ group and responsible for September 2022 GTA 6 escape, has been transferred from indefinite hospitalization in a secure clinic to a regular prison.
This change comes ahead of a new trial scheduled for November 2026, according to BBC journalist Joe Tidy. Kurtaj was initially sentenced in December 2023 to indefinite detention in a medical facility after being deemed unfit to stand trial due to a diagnosis of acute autism. The next retrial will occur the same month that GTA 6 is expected to launch, on November 19, 2026.
Details about the case remain largely undisclosed, and authorities remain tight-lipped about preparations for the retrial.
What happened in the GTA 6 2022 leak and Kurtaj’s sentence
The Kurtaj hacking incident in 2022 was on an unprecedented scale. He posted 90 clips of GTA 6 along with the game’s source code on a fan forum. The circumstances surrounding the hack made it particularly notable:
- Kurtaj was out on bail after hacking Nvidia at the time and was under police protection at a Travelodge hotel.
- He used only an Amazon Firestick, the hotel TV, and a cell phone to infiltrate Rockstar’s systems.
- The attack was successful despite their state of surveillance and monitoring.
The leak attracted widespread attention and led Rockstar Games to confirm that GTA 6 was in development, ahead of its planned official reveal.
In December 2023, a jury found Kurtaj guilty of the attacks. He was sentenced to prison in a secure hospital under conditions that could keep him there for life or until he was deemed fit to stand trial again.
The unusual sentence reflected concerns about Kurtaj’s mental health and behavior in custody. A mental health assessment cited by the BBC noted that Kurtaj continued to express his intention to return to cybercrime as soon as possible and was highly motivated. Authorities also reported dozens of incidents involving injuries or property damage while in police custody.
Transition from secure hospital to prison and new trial date in November 2026
The BBC’s Joe Tidy confirmed on Bluesky that Kurtaj has been moved from a secure hospital to a regular prison. The move suggests authorities now believe he is medically fit to stand trial. Tidy is trying to find out more about the case, but described police responses as “like getting blood out of a stone.”
The retrial is scheduled for November 2026. Kurtaj’s specific charges and his potential sentence have not been publicly revealed.
The new trial coincides with the next launch of GTA 6, scheduled for November 19, 2026, on PlayStation 5 and Xbox Series X|S. Rockstar Games confirmed the release date, opened pre-orders on June 25 for $79.99 for the Standard Edition and $99.99 for the Ultimate Edition, and released a physical edition on November 12, which includes a code in a box instead of a disc. The company continues to promote the game on the PlayStation and Xbox platforms.
The timing of Kurtaj’s retrial and the release of GTA 6 has attracted attention, in part due to its historical connection. In 2022, the game was involved in one of the largest gaming-related data breaches in history.
What the case means for cybersecurity and what to watch next
Kurtaj’s case has been referenced in cybersecurity debates for several reasons:
- The simplicity of the tools used in the attack, which included an Amazon Firestick, a hotel television, and a cell phone.
- The inability of law enforcement to prevent new cybercrimes while in custody.
- Questions about how state actors and secure environments can better protect against insider threats.
- The case set a precedent with an indefinite hospital sentence for a hacker declared unfit to stand trial.
Kurtaj was part of the Lapsus$ group, which has been linked to attacks on Nvidia, Microsoft, Samsung, Ubisoft, Okta and other high-profile targets. The group’s methods included social engineering, internal bribery, and exploitation of authentication systems.
For those following the case:
- A new trial scheduled for November 2026 will be the first opportunity for a court to re-evaluate Kurtaj’s mental capacity and criminal responsibility.
- The outcome of the new trial could influence how the UK legal system handles cybercriminals with significant mental health problems.
- Details about the retrial, including specific charges and possible sentences, will become clearer as the case progresses.
For cybersecurity professionals and developers:
- Kurtaj’s case highlights the importance of endpoint security, network segmentation and access controls.
- Even organizations with strong perimeter security can be vulnerable through social engineering or authentication flaws.
- Internal risk management remains critical, especially for organizations with access to intellectual property.
Information availability
Additional details about Kurtaj’s case are expected to emerge as the November 2026 retrial approaches. Readers can stay informed through BBC News updates from Joe Tidy and other correspondents covering the story, as well as through the UK’s court reporting services for filed documents and hearing schedules.
For official statements from the parties involved, stay tuned for announcements made by Rockstar Games and Take-Two Interactive, although the company has not commented on the new trial. Instead, Rockstar Games is currently focused on preparations for the launch of GTA 6 on November 19.
The game is still scheduled for release on PlayStation 5 and Xbox Series X|S, while a PC version has yet to be confirmed.
