--:-- Jessica Mendoza: Welcome to The Journal, our show about money, business, and power. I'm Jessica Mendoza.
--:-- Ryan Knutson: And I'm Ryan Knutson.
--:-- Jessica Mendoza: It's Wednesday, October 16th. Today, we're talking about a teenage hacker who became a legend, attacking companies like Nvidia, Microsoft, and Uber. Our guest, Bob McMillan, has been following this story. Bob, thanks for coming on the show.
--:-- Bob McMillan: Thanks for having me.
--:-- Ryan Knutson: So, about two years ago, Nvidia, the world's most valuable chip company, was the victim of a major hack. Well, developing news tonight on a mysterious overseas hacking group targeting major tech companies. Nvidia, one of the biggest chip makers around the world, got hacked last Friday. And a massive trove of data was leaked onto the internet.
--:-- Jessica Mendoza: I learned of this attack via Twitter, and it was not like anything I'd really ever seen before. So there was a hacking group that not a lot of people had heard about. And they showed up one day and said that they had broken into Nvidia. And they were like super loud about it, like bragging about it.
--:-- Bob McMillan: They claimed to have all kinds of source code and schematics and basically proprietary data that would be of great interest to like a rival chip maker. But then ultimately, these hackers dumped a bunch of data. And at that point, it was very clear that they had broken into Nvidia.
--:-- Ryan Knutson: Pulling off a hack on a company as big and secure as Nvidia is already a feat. But Bob was even more surprised when he learned who was behind the attack.
--:-- Jessica Mendoza: It turns out that one of the people behind the hack was Arian Kurtaj, who was a 17-year-old hacker. And cybersecurity investigators say that Kurtaj has been involved in illegal online activity since he was 11.
--:-- Bob McMillan: And I was playing D&D, and I was definitely playing video games big time. And like Bob, Aaron Kurtage was taking his gaming to a more advanced level, because he was also apparently starting to hack.
--:-- Jessica Mendoza: By 17, Kurtage had become one of the most infamous hackers in the world, breaking into major multinational companies. We're talking about Microsoft, Samsung, Uber, Nvidia. He caused millions and millions of dollars worth of economic damage.
--:-- Ryan Knutson: And it's just fascinating that somebody so young could be so successful. And he's part of what seems to be a growing phenomenon and one that really has law enforcement authorities flummoxed.
--:-- Jessica Mendoza: Kurtage's family declined to be interviewed. His lawyers have acknowledged that there was evidence Kurtaj was associated with hackers in some of their activities. But they also said that the evidence failed to prove he committed many of the offenses alleged by prosecutors, or that he was the central player.
--:-- Bob McMillan: Cybercrime experts say that hackers are getting younger and younger. And some of those teenage hackers have gotten very good at what they do.
--:-- Ryan Knutson: It used to be we were worried about the Russians, the Chinese, the Iranians, and the North Koreans. And these teenagers are definitely up there with all those actors, just in terms of the impact that they're having.
--:-- Jessica Mendoza: So it's a big problem. Welcome to The Journal, our show about money, business, and power. I'm Jessica Mendoza. It's Wednesday, October 16th.
--:-- Ryan Knutson: Coming up on the show, the teenager who became a hacking legend and the race to catch him. We'll be right back.
--:-- Ryan Knutson: On brand with Jimmy Fallon. Series premiere Tuesday on NBC.
--:-- Hey, business owners. We know you know the importance of maximizing every dollar. With the Delta SkyMiles Reserve Business American Express card, you can make your expenses work just as hard as you. From afternoon coffee runs to stocking office supplies and even team dinners, you can earn miles on all your business expenses. Plus, you can earn 125,000 bonus miles for a limited time through October 29th.
--:-- Jessica Mendoza: Today Arian Kurtaj is 19 years old. He grew up in the UK and as a kid he had trouble in school. He was born autistic. He was a very difficult kid to raise. And his behavioral problems, as he got older, they became increasingly unmanageable.
--:-- Bob McMillan: You know, I think he was a kid from a family without a ton of means who basically was not thriving in any way in the real world and who turned to the virtual world, you know, for his identity, his whole identity.
--:-- Jessica Mendoza: Kurtaj spent a lot of time online playing video games. According to Bob's reporting, as Kurtaj got deeper into gaming, he started finding out about techniques on how to win, including hacking his opponents.
--:-- Bob McMillan: Soon, Kurtaj moved beyond trying to win video games to committing major cyber crimes. So that was in June of 2021. Kurtaj would have been 16 at this time.
--:-- Jessica Mendoza: And a video game maker, Electronic Arts, gets broken into. These people had their intellectual property stolen. Videos of games and source code are taken. There was a demand for money for $28 million.
--:-- Bob McMillan: But it almost seemed like it wasn't serious. Electronic Arts didn't send over any money. In retaliation, the group of hackers, which included Kurtage, dumped company data online.
--:-- Jessica Mendoza: Soon after, Kurtage joined forces with another teenager and several Brazilian hackers. They called themselves Lapsis. And they started targeting some big companies.
--:-- Bob McMillan: Everybody on the team has a different set of skills. And together they're kind of more powerful than they are individually.
--:-- Jessica Mendoza: So by August, Kurtage and his associates have broken into a British telecom company. And when they had access, Kurtage and his associates were basically selling sim swaps to other people.
--:-- Bob McMillan: Sim swapping is a hacking technique. It was pioneered by teenage hackers who use it to take over online accounts.
--:-- Jessica Mendoza: Here's how it works. A hacker calls up a cell phone provider and tricks the customer service person into transferring a phone number to a new SIM card. Whoever has that SIM card then has access to other accounts linked to that phone number.
--:-- Bob McMillan: Sim swapping is key to taking over gaming accounts, taking over coveted Twitter accounts or Instagram accounts, and then selling them. Taking over cryptocurrency accounts like Coinbase accounts and making some real money.
--:-- Jessica Mendoza: And SIM swapping is good for that. Through sim swapping, Kurtage and the hacker group Lapsus made a lot of money.
--:-- Bob McMillan: In late 2021, Kurtage made a big purchase. He bought this website called Docspin. It's kind of a social network, really. It's a site that's devoted to publishing docs of people. In other words, publishing private information that they probably wouldn't want disclosed.
--:-- Jessica Mendoza: This can be like phone numbers, relatives' phone numbers, online account names, addresses, things like that. And so when you dox somebody, especially if you dox a hacker, you know, you're destroying their anonymity. You're showing where they live. And you're also providing law enforcement investigators with valuable information that they can use to pursue their investigation.
--:-- Bob McMillan: So if you're doxing another hacker, it can really lead to their arrest.
--:-- Jessica Mendoza: So he bought Doxpin. He bought Doxman. Yeah, he paid $75,000 and took over the site. Do we know why? Well, I mean, my guess is that it would be the ultimate power move, right? In this community, Doxman is at the center. And so it's a position of prestige within the community that Kurtage is like rapidly becoming very well known in.
--:-- Bob McMillan: According to Bob's reporting, Kurtage's community of fellow hackers and doxers didn't like the way he was running the site. And eventually, the previous owners pressured Kurtaj to sell the site back to them.
--:-- Jessica Mendoza: And his parting gesture to the Doxman community was to basically dump all the private information that he had access to as the owner. Wow. And essentially dox all the doxers, you know.
--:-- Bob McMillan: So he published a lot of information that people wish he hadn't published. And he angered people even more.
--:-- Jessica Mendoza: And so that pisses off a lot of people.
--:-- Bob McMillan: What are the consequences for Kurtage? Well ultimately Kurtage got doxed and he got doxed in what has been described as like the most complete dox of all time. It had and I seen this document it got like every alias that he ever used. It's got his home address, it's got his mom's address, it's got his father's address, family, other, you know, extended family members.
--:-- Jessica Mendoza: It wasn't only Kurtage's private information that went public. It was also what he looked like. The dox included personal photos of Kurtage.
--:-- Bob McMillan: In one of them, he's on a boat holding a big brown fish that looks like it was just pulled out of the water.
--:-- Jessica Mendoza: The docks happened in January of 2022. That same month, authorities, who had been tracking Kurtaj for some time, arrested him on suspicion of the SIM card telecom hack.
--:-- Bob McMillan: But because they were still early in their investigation, after seizing his digital devices, they released him. They're like, we know who you are. We're investigating you. Beware. Charges could be coming, you know.
--:-- Jessica Mendoza: And so, roll back to, like, teenage me, like, I would be scared to death by the cops showing up at my house, and I would definitely have stopped my hacking at that point.
--:-- Bob McMillan: But Kurtage did not. Not only did Kurtage continue hacking, but his biggest and most ambitious attacks were yet to come.
--:-- Jessica Mendoza: That's next.
--:-- Ryan Knutson: Mint is still $15 a month for premium wireless. And if you haven't made the switch yet, here are 15 reasons why you should. One, it's $15 a month. Two, seriously, it's $15 a month. Three, no big contracts. Four, I use it. Five, my mom uses it.
--:-- Jessica Mendoza: Are you playing me off? That's what's happening, right? Okay. Give it a try at mintmobile.com slash switch. Upfront payment of $45 for three-month plan, $15 per month equivalent required. New customer offer first three months only, then full price plan options available. Taxes and fees extra. See mintmobile.com.
--:-- Ryan Knutson: Running a business comes with a lot of what-ifs. But luckily, there's a simple answer to them. Shopify. It's the commerce platform behind millions of businesses, including Thrive Cosmetics and Momofuku.
--:-- Jessica Mendoza: And it'll help you with everything you need. From website design and marketing to boosting sales and expanding operations, Shopify can get the job done and make your dream a reality.
--:-- Ryan Knutson: Turn those what-ifs into... Sign up for your $1 per month trial at shopify.com slash special offer.
--:-- Jessica Mendoza: In February 2022, Curtage and the hacking group Lapsus broke into the behemoth chipmaker, Nvidia. And why was the NVIDIA hack in particular, why was that a big deal?
--:-- Bob McMillan: Well, Nvidia, I mean, their market value today, I think, is $3 trillion. You know, they're an incredibly important company. They're well-heeled. They have intellectual property that's, like, extremely valuable.
--:-- Jessica Mendoza: And the fact that a couple of teenagers could break into this company is, you know, no matter who did it, like, a hack of Nvidia would be noteworthy. Right. But the fact that it was just these lapsus kids doing it was even more remarkable.
--:-- Ryan Knutson: A month later, the police arrested Kurtage again. But because Kurtage has severe autism and other developmental issues, authorities couldn't find an appropriate facility to hold him.
--:-- Jessica Mendoza: So he was released again, this time on the condition that he stayed off the internet.
--:-- Bob McMillan: Even though he wasn't under arrest anymore, Kurtage, whose private information was still public, had other problems to deal with. Over the next few months, according to the police, Kurtage started to get harassed.
--:-- Jessica Mendoza: Someone threw bricks at the windows of his family's home. His mom's car was smashed up. And authorities found evidence of a plot to steal cryptocurrency from him.
--:-- Ryan Knutson: So the police came up with a plan to keep him safe. By September, they moved Kurtage and his mom into a travel lodge, a hotel just outside of Oxford.
--:-- Jessica Mendoza: The police had this system where when they knocked on the door to let Kurtage know it was really them, the code word that they used was lucky lucky.
--:-- Bob McMillan: But even with all this going on in his life, and in order to stay offline, that didn't stop Kirtage.
--:-- Jessica Mendoza: Are there any big hacks that happen while he is at this hotel? Yeah, there are a couple of big hacks that happen while he was at this hotel.
--:-- Ryan Knutson: The first one was Uber, and then even more remarkably, he breaks into Rockstar, which, as all good gamers know, is developing Grand Theft Auto 6.
--:-- Jessica Mendoza: And he starts releasing like unreleased video clips from Grand Theft Auto and code from it The Rockstar Games hack was a big deal in the gaming and hacker community.
--:-- Bob McMillan: And it wasn't long before a rival hacker posted that it was Kurtage who had done it.
--:-- Ryan Knutson: Now, police suspected he wasn't just sitting around doing nothing at the Travelodge Hotel.
--:-- Jessica Mendoza: So how did police try and stop him? So they go to the Travelodge. You know, they're supposed to say lucky, lucky when they knock on the door so that he knows it's the cops.
--:-- Bob McMillan: So they come up to his door, get into the room. And there he is. He's got this like Amazon Fire Stick with Internet access. He's got an iPhone as well. So he's got like two devices that can connect to the Internet.
--:-- Jessica Mendoza: He's not supposed to have any. And he appeared to be in the process of like bragging about these hacks. like just right up to the minute that he was arrested.
--:-- Ryan Knutson: Kurtage was arrested and charged with 12 counts of hacking, fraud, and blackmail.
--:-- Jessica Mendoza: But due to his autism and developmental issues, psychiatrists deemed him unfit to stand trial for the question of criminal intent.
--:-- Bob McMillan: So the judge told the jury to only determine whether or not Kurtage had done the alleged acts.
--:-- Jessica Mendoza: And the court found that, yes, indeed, he did them. And they said, we're going to basically convict him of all this, but we're going to sentence him to a mental facility, not a criminal detention center.
--:-- Ryan Knutson: And he's going to stay there until the doctors decide he is fit to come back into society. He's no longer a threat to society.
--:-- Jessica Mendoza: Kirtage and his lawyers are seeking to appeal. They argued at trial that while there was evidence of Kurtage's association with hackers and the offenses, it failed to prove he committed many of the offenses or was the central player.
--:-- Bob McMillan: His lawyers have also said that a potential lifetime of incarceration is not appropriate for a teenager like Kurtage.
--:-- Jessica Mendoza: What is the takeaway here, Bob? Like, what does this story tell us about this moment in cybercrime?
--:-- Ryan Knutson: Here in the United States, the Department of Justice typically doesn't even pursue cases against teenage hackers, right? So typically, if the feds find out that the subject of their investigation is a teenager, they'll stop. They just won't prosecute.
--:-- Jessica Mendoza: So bottom line, law enforcement has a really hard time prosecuting teenagers, and in particular, teenagers with special needs.
--:-- Bob McMillan: And so what is the next step here? if this is something that needs to be prevented moving forward?
--:-- Ryan Knutson: Well, the FBI is taking an interest in addressing this problem. Since lapsus, there have been other groups that have popped up.
--:-- Jessica Mendoza: You can almost look at lapsus like these kind of like teenagers, you know, pioneering the playbook, and then other groups like going to bank with it.
--:-- Bob McMillan: And they're not the only entities that are engaged in this type of activity.
--:-- Jessica Mendoza: So there's like a real worry that the professionalized criminals are going to ally themselves with these super capable teenagers and young people and just create an unholy alliance that really is going to be very difficult to stop and is going to be responsible for an increasing level of economic damage.
--:-- Ryan Knutson: And I think probably the consensus is that there needs to be some kind of intervention program, right? There needs to be some kind of way of taking these kids at an early stage and directing them into something that is less harmful than stealing cryptocurrency or SIM swapping or breaking into Nvidia.
--:-- Jessica Mendoza: And it's going to be hard.
--:-- Bob McMillan: Well, thanks for coming on the show, Bob. We really appreciate it.
--:-- Ryan Knutson: Next time, I promise it'll be about something fun. Something uplifting, you know, something that'll make you optimistic about the human condition.
--:-- Jessica Mendoza: It's like, oh, no, we're all going to get hacked and it's going to be my teenager. It's all getting worse. It's getting worse. The teens. The teens. It's just.
--:-- Ryan Knutson: That's all for today, Wednesday, October 16th. The Journal is a co-production of Spotify and The Wall Street Journal. Additional reporting in this episode by Jenny Strasberg. Thanks for listening. See you tomorrow.
--:-- Jessica Mendoza: You
