What Happened to Lapsus$?

Lapsus$ emerged in late 2021, quickly establishing itself as a significant threat in the cybercrime landscape through a series of high-profile data breaches and extortion attempts. The group targeted a diverse range of organizations, including government agencies and major players in the technology, telecommunications, and gaming sectors. Their modus operandi primarily involved social engineering, SIM swapping, and the recruitment of insiders to gain initial access to target networks, often eschewing complex malware in favor of human vulnerabilities. Once access was established, Lapsus$ would exfiltrate sensitive data and then threaten to leak it publicly if their demands were not met, frequently utilizing Telegram channels for communication, public shaming, and even recruitment.

The group's motivations were multifaceted, encompassing financial gain, a desire for notoriety, and what some described as acting "for the lulz" – seeking thrills and recognition. This was evident in their public boasting and unconventional demands, such as compelling Nvidia to open-source its device drivers. The success of Lapsus$ underscored critical vulnerabilities in organizational security, particularly concerning human-centric attacks, weak identity management, and the need for robust internal communication and access control policies.

Key turning points in the Lapsus$ saga began in December 2021 with their first major attack on the Brazilian Health Ministry. The group gained international notoriety through a spree of attacks in early 2022 against tech giants like Nvidia, Samsung, Microsoft, Okta, and Vodafone. This led to initial arrests by the City of London Police in March 2022, with seven individuals apprehended. Despite these arrests, Lapsus$ re-emerged in September 2022, targeting companies such as Uber and Rockstar Games, which resulted in further arrests in both the UK and Brazil. A significant legal development occurred in August 2023 when a London jury convicted two British teenagers, including prominent member Arion Kurtaj, for their involvement in the hacks. In December 2023, Kurtaj, who is autistic and was deemed unfit to stand trial, was sentenced to an indefinite hospital order due to his persistent intent to commit cybercrime.

The consequences of Lapsus$'s activities were substantial, including significant financial losses for victim companies, estimated at nearly $10 million from attacks on Uber, Nvidia, and Rockstar Games alone. Beyond financial damages, companies suffered reputational harm and the exposure of sensitive data, prompting a re-evaluation of cybersecurity strategies to better address social engineering and insider threats. Several members faced legal repercussions, with some receiving custodial sentences or hospital orders.

As of September 12, 2026, the status of Lapsus$ remains complex. While key members like Arion Kurtaj have been convicted and are in secure facilities or awaiting trial (Kurtaj was transferred to a standard prison in July 2026), the "Lapsus$" brand continues to be associated with cybercrime. In May 2026, a Lapsus$-GROUP, in collaboration with TeamPCP, claimed a breach of GitHub, exfiltrating approximately 4,000 private repositories. More recently, on September 9, 2026, a Lapsus$-branded actor announced a return to active operations, explicitly challenging the FBI and federal law enforcement, and initiated a countdown for a "Chapter II" victim leak. It is important to note that "Lapsus$" branding might be used by multiple distinct actor clusters, including "Scattered Lapsus$ Hunters" (SLH), making definitive attribution challenging. SOCRadar listed Lapsus$ as "active" as of September 6, 2026, indicating ongoing monitoring of entities operating under this name.