A London jury has found that a teenage member of the Lapsus$ hacking group carried out the high-profile cyberattacks on Rockstar Games, Uber, and Nvidia, according to a report from the BBC. The Southwark Crown Court jury that the 18-year-old Arion Kurtaj committed 12 offenses, including blackmail, fraud, and several violations of the UK’s Computer Misuse Act.

Kurtaj was arrested several times within the past two years but continued to carry out cyberattacks on several companies, such as Nvidia, by using social engineering and SIM-swapping techniques. London police arrested Kurtaj for the final time in September 2022 after he violated bail conditions that banned him from using the internet.

According to the BBC, prosecutors told the court that Kurtaj brought an Amazon Fire Stick into the hotel where he was staying, “allowing him to connect to cloud computing services with a newly purchased smart phone, keyboard and mouse.” During that time, Kurtaj released gameplay videos of the not-yet-released Grand Theft Auto VI after threatening its developers, Rockstar Games.

Kurtaj also hacked Uber and the financial company Revolut. According to the BBC, Kurtaj wasn’t fit to stand trial, so the jury was “asked to determine whether or not he did the acts alleged — not if he did it with criminal intent.” The jury also convicted another 17-year-old Lapsus$ member who remains unnamed due to his age. London police also arrested several other teens with ties to Lapsus$ last year.

The Lapsus$ hacks have forced companies and organizations around the globe to rethink their cybersecurity measures. Earlier this month, the US Cybersecurity and Infrastructure Security Agency published a detailed report calling for stricter SIM swapping protections and the transition to a passwordless future in light of the Lapsus$ hacks. The agency said the group gave it a “propitious lens through which we could see systemic issues in the digital ecosystem.”

Correction August 24th, 8:18AM ET: A previous version of the article stated that Kurtaj was found guilty. However, the jury was asked to find whether he committed these acts, not if did it with criminal intent. We regret the error.