{ "id": "f2480f1b-aec5-47f6-bee7-5641905c3766", "created_at": "2026-04-06T00:11:02.938222Z", "updated_at": "2026-04-10T13:11:58.098519Z", "deleted_at": null, "sha1_hash": "99ac2dd3ca454962b66c08885423148b9fd9d146", "title": "UK Police arrests teen believed to be behind Uber, Rockstar hacks", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1971856, "plain_text": "UK Police arrests teen believed to be behind Uber, Rockstar hacks\r\nBy Lawrence Abrams\r\nPublished: 2022-09-23 · Archived: 2026-04-05 21:53:42 UTC\r\nThe City of London police announced on Twitter today the arrest of a British 17-year-old teen suspected of being involved\r\nin recent cyberattacks.\r\nIn a short tweet shared by law enforcement, the teen was arrested in Oxfordshire as part of a hacking investigation supported\r\nby the UK's National Crime Agency.\r\n\"On the evening of Thursday 22 September 2022, the City of London Police arrested a 17-year-old in Oxfordshire\r\non suspicion of hacking, as part of an investigation supported by the @NCA_UK’s National Cyber Crime Unit\r\n(NCCU).\r\nHe remains in police custody\" - City of London Police.\r\nBleepingComputer has reached out to the NCA and City of London police to learn more about this investigation.\r\nhttps://www.bleepingcomputer.com/news/security/uk-police-arrests-teen-believed-to-be-behind-uber-rockstar-hacks/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/uk-police-arrests-teen-believed-to-be-behind-uber-rockstar-hacks/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\nNCA referred us to the City of London, stating it was their investigation, while the latter said they have no further\r\ninformation to share and any new information that would be posted on Twitter.\r\nBleepingComputer also reached out to the FBI regarding the suspect’s possible involvement in the Uber attack but has not\r\nimmediately received a response.\r\nResearchers believe the arrest is tied to Lapsus$\r\nWhile there are no details about the investigation, the arrest is believed to be tied to the Lapsus$ hacking group, which is\r\nsuspected to be behind recent cyberattacks on Uber, Rockstar Games, and 2K.\r\nDuring last year's attacks, the Lapsus$ hacking group was said to be led by a threat actor named 'White' or 'BreachBase,'\r\nwho was doxxed as allegedly a 16-year-old teen from the UK. This hacking group is responsible for numerous high-profile\r\nattacks, including Microsoft, Cisco, NVIDIA, Samsung, and Okta.\r\nIn April, the City of London Police arrested seven people aged 16 to 21, including the alleged 17-year-old ringleader.\r\nHowever, the UK soon released the two boys on bail as they were minors.\r\nLast Thursday, Uber disclosed they were responding to a cyberattack after a hacker, known as 'TeaPots,' gained access to\r\ntheir Slack server and began posting screenshots of their access to other internal services.\r\nThree days later, on Sunday, a threat actor calling themselves 'teapotuberhacker' began leaking previously unseen Grand\r\nTheft Auto 6 video footage and snippets of source code for GTA V and GTA VI on GTAforums.com.\r\nThis threat actor claimed that they breached Rockstar Game's Slack and Confluence servers to steal the data and also said\r\nthey were behind the recent attack on Uber.\r\nThe owner of the Breached hacking forum, pompompurin, was the first to claim claimed that White was behind the Rockstar\r\nGames and Uber attacks.\r\nSoon after, Uber also attributed the attack to the Lapsus$ hacking group, which used MFA Fatigue attacks and other tactics\r\nthat are known to be associated with this hacking group.\r\nMore recently, gaming company 2K also suffered a security breach, where the threat actor used their help desktop to send\r\nmalware to customers. While there is no formal attribution to Lapsus$, 2K is owned by Take-Two Interactive, the parent\r\ncompany of Rockstar Games.\r\nDue to the recent attacks, the attribution, and the age and location of the arrested individual, many in the cybersecurity\r\ncommunity believe that the arrest is linked to the Lapsus$ group.\r\nJournalist Matthew Keys says that it was a 17-year-old boy who was arrested over the hack of Rockstar, and likely Uber.\r\nHowever, as the suspect is a minor, their name cannot be released by law enforcement under UK law.\r\nThis is a developing story and will be updated as more information is revealed.\r\nhttps://www.bleepingcomputer.com/news/security/uk-police-arrests-teen-believed-to-be-behind-uber-rockstar-hacks/\r\nPage 3 of 4\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/uk-police-arrests-teen-believed-to-be-behind-uber-rockstar-hacks/\r\nhttps://www.bleepingcomputer.com/news/security/uk-police-arrests-teen-believed-to-be-behind-uber-rockstar-hacks/\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://www.bleepingcomputer.com/news/security/uk-police-arrests-teen-believed-to-be-behind-uber-rockstar-hacks/" ], "report_names": [ "uk-police-arrests-teen-believed-to-be-behind-uber-rockstar-hacks" ], "threat_actors": [ { "id": "be5097b2-a70f-490f-8c06-250773692fae", "created_at": "2022-10-27T08:27:13.22631Z", "updated_at": "2026-04-10T02:00:05.311385Z", "deleted_at": null, "main_name": "LAPSUS$", "aliases": [ "LAPSUS$", "DEV-0537", "Strawberry Tempest" ], "source_name": "MITRE:LAPSUS$", "tools": [ "Mimikatz" ], "source_id": "MITRE", "reports": null }, { "id": "d4b9608d-af69-43bc-a08a-38167ac6306a", "created_at": "2023-01-06T13:46:39.335061Z", "updated_at": "2026-04-10T02:00:03.291149Z", "deleted_at": null, "main_name": "LAPSUS", "aliases": [ "Lapsus", "LAPSUS$", "DEV-0537", "SLIPPY SPIDER", "Strawberry Tempest", "UNC3661" ], "source_name": "MISPGALAXY:LAPSUS", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "2347282d-6b88-4fbe-b816-16b156c285ac", "created_at": "2024-06-19T02:03:08.099397Z", "updated_at": "2026-04-10T02:00:03.663831Z", "deleted_at": null, "main_name": "GOLD RAINFOREST", "aliases": [ "Lapsus$", "Slippy Spider ", "Strawberry Tempest " ], "source_name": "Secureworks:GOLD RAINFOREST", "tools": [ "Mimikatz" ], "source_id": "Secureworks", "reports": null }, { "id": "52d5d8b3-ab13-4fc4-8d5f-068f788e4f2b", "created_at": "2022-10-25T16:07:24.503878Z", "updated_at": "2026-04-10T02:00:05.014316Z", "deleted_at": null, "main_name": "Lapsus$", "aliases": [ "DEV-0537", "G1004", "Slippy Spider", "Strawberry Tempest" ], "source_name": "ETDA:Lapsus$", "tools": [], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434262, "ts_updated_at": 1775826718, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/99ac2dd3ca454962b66c08885423148b9fd9d146.pdf", "text": "https://archive.orkl.eu/99ac2dd3ca454962b66c08885423148b9fd9d146.txt", "img": "https://archive.orkl.eu/99ac2dd3ca454962b66c08885423148b9fd9d146.jpg" } }