Quick Answer — On August 31, 2023, a London jury convicted two teenagers for the LAPSUS$ spree — the 2021–22 hackathon that breached Nvidia, Microsoft, Okta, Uber, Revolut, and Rockstar Games using nothing more exotic than SIM swaps, helpdesk manipulation, and stolen credentials. The convictions put a legal period on the saga, but the real verdict was aimed at defenders: a handful of teenagers with commodity techniques dismantled the assumptions of billion-dollar identity stacks. If your helpdesk can be talked into resetting an executive, your firewall budget is theater.
The LAPSUS$ file is the definitive case study in social engineering as prime exploitation: no zero-days, no malware sophistication — just humans, phones, and the MFA button users love to press. The convictions closed the criminal chapter; the defensive chapter is still being written.
What happened
- The group: LAPSUS$ — a loose, young, mostly UK- and Brazil-based collective that operated via Telegram, bragged loudly, and monetized through extortion and chaos rather than encryption.
- The methods: SIM swaps to hijack phone numbers, helpdesk social engineering to reset credentials, MFA-fatigue push bombing, and credentials harvested from infostealer-log markets — all commodity techniques available to anyone with a phone and patience.
- The verdicts: Per UK court reporting, Arion Kurtaj (18) was convicted of the hack acts — including breaching Rockstar with a hotel TV, an Amazon Fire Stick, and a hotel phone while under police protection — his devices sat in police custody. A 17-year-old co-defendant (anonymized) was convicted on minor counts and later received a rehabilitation order.
- The sentencing coda: In September 2023, Kurtaj — deemed unfit to stand trial in the conventional sense — received an indefinite hospital order after a jury found he committed the acts.
Why teenagers beat enterprise identity
| Weakness | How LAPSUS$ used it |
|---|---|
| Helpdesk trust | Phone + plausible story beats verification scripts; resets are the crown-jewel moment |
| SMS-based recovery | SIM swap converts your phone number into their skeleton key |
| MFA fatigue | Push-spam until a tired user approves “to make it stop” |
| Stealer-log economy | Credentials already circulating from malware infections feed the first foothold |
| Insider recruitment | Reported attempts to pay employees of target firms for access |
Timeline
| Date | Event |
|---|---|
| 2021 | LAPSUS$ emerges, hitting Brazilian targets first before going global |
| 2022-02 → 03 | Nvidia and Microsoft breached; Okta contractor compromise follows, with screenshots posted for chaos |
| 2022-09 | Uber (MFA fatigue + VPN creds) and Rockstar (GTA VI leak — 90 clips from a Slack takeover) in the same week |
| 2022-09 → 2023 | City of London Police arrests; group effectively dismantled though copycats continue the pattern |
| 2023-08-31 (event; our peg) | Southwark Crown Court jury convicts Kurtaj and the 17-year-old co-defendant after a seven-week trial of the acts |
| 2023-09 → 12 | Kurtaj receives indefinite hospital order; co-defendant a youth rehabilitation order — the criminal chapter closes |
Defensive lessons
- Treat the helpdesk as your most attacked surface. Every reset is an authentication decision made under social pressure; verification must be number-based, out-of-band, and immune to a good story.
- Kill SMS recovery for anyone who matters. SIM swapping works because carriers are soft targets; passkeys, hardware keys, and number-free recovery paths remove the entire lever.
- Rate-limit and monitor MFA pushes. Fatigue attacks are visible in telemetry — twenty pushes in ten minutes should page a human, not just annoy one.
- Screen your users against stealer logs. If your workforce’s credentials circulate in malware datasets, assume the first foothold already exists; forced resets in advance deny the cheap entry.
- Assume Slack/takeover blast radius. LAPSUS$ weaponized internal messaging for reputational damage; internal comms tools need admin-session anomalies watched like production.
The unfit-to-stand-trial nuance
The case’s oddest legal wrinkle — worth understanding because coverage mangles it — is that Kurtaj was found unfit to participate in his own trial (per psychiatric assessment), so the jury was asked only whether he committed the acts, not whether he possessed criminal intent in the ordinary sense of a standard criminal conviction. That procedural shape is why the eventual disposition was a hospital order rather than a prison term. For the security record, nothing changes: the acts were proven — including the almost surreal detail that the Rockstar intrusion was conducted from a hotel room using a television, a Fire Stick, and a phone while police held his actual computers. If there is a more vivid argument that access control must assume attacker creativity, it hasn’t been filed.
Why it still matters in 2026
Every major identity incident since has reused some fragment of the LAPSUS$ playbook — MFA-fatigue at MGM weeks later, helpdesk resets against countless orgs, stealer-log-driven intrusions at scale. The industry response coalesced into what we now teach as baseline: phishing-resistant MFA, verified reset workflows, number matching, and credential-exposure monitoring. The teenagers were the stress test that proved identity — not the network — is the perimeter; the convictions just made the study permanent.
Who exactly were LAPSUS$?
Per law-enforcement and court reporting: a small core of teenagers (with a wider circle of hangers-on and copycats) coordinated over Telegram, motivated as much by notoriety as by money. Their opsec was poor — videos, brags, and traces everywhere — which is precisely how the City of London Police rolled them up within months.
Did the companies lose data or money?
Both, unevenly. Nvidia and Samsung saw source-code and credential leaks; Okta suffered a contractor foothold with reputational damage outsized to technical impact; Uber’s intruder wandered internal systems; Rockstar suffered the most famous content leak in gaming history. Direct ransom payments were rarely the outcome — extortion demands often weren’t paid.
Were they really teenagers?
Yes — the convicted core were 16–18 at the time of the crimes, and UK reporting anonymized several minors throughout. The disconnect between attacker profile and victim scale remains the case’s headline lesson.
What happened after the convictions?
The named principal was hospitalized indefinitely; the minor received a rehabilitation order. The group’s brand flickered among copycats, but the specific spree ended with the arrests. Their techniques, unfortunately, became permanent infrastructure — adopted by far less selective criminals.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
Where this sits in the broader pattern
The LAPSUS$ convictions (2024, UK) closed the loop on the most instructive intrusion crew of the decade: teenagers, no malware sophistication to speak of, and compromises of Microsoft, Okta, Uber, Rockstar (the GTA VI leak in this series), Nvidia, and others — primarily through help-desk social engineering, credential purchases, and MFA-fatigue. The convictions confirmed the profile: the crew that humbled trillion-dollar security programs was largely minors motivated by status, not money.
The pattern the crew perfected is now standard adversary tradecraft: buy or phish a credential, overwhelm MFA with push fatigue or bypass it through help-desk reset, enroll attacker-controlled MFA, then abuse internal tooling (Slack, IT admin consoles, code repositories) that assumed anyone authenticated was trustworthy. Every control that failed was an assumption wearing a uniform. The defensive generation that answered — phishing-resistant MFA, help-desk verification hardening, number matching, and insider-risk monitoring on privileged tooling — exists because this crew made the assumptions visible.
The judicial aftermath added its own lesson: the sentences reflected juvenile status and coercion findings, and two defendants were later connected to further activity including the Snowflake-adjacent era credential economy. The crew dispersed; the tradecraft did not. Defensive doctrine that assumes skilled, funded, patient adversaries must also survive contact with bored teenagers holding purchased credentials — because empirically, the latter has taken down more giants.
The bottom line. The most consequential intrusion crew of the decade was teenagers with help-desk phone numbers — proof that identity-process attacks scale without sophistication. Harden the human verification paths like the perimeter they became, deploy phishing-resistant MFA, and monitor privileged tooling for authenticated-but-wrong behavior. The giants fell to social engineering; the lessons stand at help-desk height.
The help-desk hardening checklist LAPSUS$ wrote
Because the crew primary weapon was the verification process itself, the remediation checklist is unusually concrete. Identity verification for support interactions: callbacks to numbers on file rather than accepting inbound claims; knowledge requirements that include non-public account data an attacker cannot buy; and video- or document-verification steps whose artifacts are themselves monitored for deepfake-era manipulation — the 2024-2026 requirement this site covers in its AI fraud analysis.
MFA process hardening: number matching and push throttling to defeat fatigue; re-verification (not just reset) for any MFA enrollment change; and rate-limited, alerted reset flows that treat repeated targeting of one account as an attack signal rather than separate tickets. The crew cycled through reset flows precisely because each request looked individually plausible; correlation across requests is the detection.
Privileged-tooling monitoring: internal admin consoles, Slack workspaces with sensitive channels, code repositories, and identity providers need behavioral baselines — authenticated-but-anomalous usage is the LAPSUS$ signature, since their tradecraft never needed exploits. And organizational: the crew leveraged the reality that help desks are staffed for courtesy under staffing pressure; the hardening budget must include staffing levels that make verification affordable, because a queue under pressure will always trade diligence for throughput.
The checklist stands at help-desk height, which is the point: the decade most consequential intrusions walked through the most human door in the building. Harden it with the seriousness the incident record now demands — callbacks, correlation, staffing — and the giants fall no further.
Frequently Asked Questions
{“@context”:”https://schema.org”,”@type”:”FAQPage”,”mainEntity”:[{“@type”:”Question”,”name”:”Who were the LAPSUS$ hackers?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”A mostly UK-based group of teenagers that compromised Microsoft, Okta, Uber, Nvidia, and Rockstar Games using social engineering, purchased credentials, and MFA-fatigue attacks — several members were convicted in 2024, with sentences reflecting their juvenile status.”}},{“@type”:”Question”,”name”:”How did LAPSUS$ bypass MFA at major companies?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Through MFA-fatigue push bombardment, abuse of recovery and help-desk reset processes, and enrolling their own authenticators once inside — exploiting verification procedures rather than breaking cryptography.”}},{“@type”:”Question”,”name”:”What defenses stop LAPSUS$-style attacks?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Phishing-resistant MFA (hardware keys, passkeys), hardened help-desk identity verification with callback procedures, number-matching prompts, and behavioral monitoring on internal privileged tooling.”}}]}
Related Reading
- What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
- Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
- 2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor
- Authoritative reference: CISA Known Exploited Vulnerabilities
- Facebook 533M Leak: Old Scraped Data Never Stops Burning
- Marriott’s FTC Settlement: 20 Years of Audits for Starwood’
- Genesis Market Takedown: Sessions Are the New Passwords
