Lapsus$ teen sentenced to indefinite detention in hospital for Nvidia, GTA cyberattacks

Two members of the Lapsus$ cyber-crime group — an 18-year-old (Arion Kurtaj) and a 17-year-old — were sentenced for a spree of intrusions, extortion, and data theft targeting major firms (Nvidia, Uber, Revolut, Microsoft, Okta, Rockstar Games and others). The report describes large-scale data exfiltration (including 1TB taken from Nvidia with 80GB publicly shared), use of social engineering, SIM swapping, and buying employee credentials/MFA codes, and notes psychiatric findings, sentencing outcomes, and US government guidance to move away from SMS/voice MFA toward hardware-backed or biometric authentication.