A teenager from Oxford has been arrested on suspicion of being part of a hacking gang that has breached systems at companies including Microsoft.
The boy has allegedly been living a double life in which his family were unaware of his online identity as a member of Lapsus$. The group is rumoured to have extorted or stolen more than £10 million from businesses and state-run systems.
Researchers who worked on identifying the hacker — known as White — have said that his skill and speed had initially led them to believe they were monitoring an automated cyberattack.
The boy’s father told the BBC: “I had never heard about any of this until recently. He’s never talked about any hacking but he is very good on computers and spends a lot of time on the computer. I always thought he was playing games.”
He said the family were trying to keep the teenager, who has been released under investigation, away from computers. Lapsus$ gained notoriety with attacks on companies including Microsoft, Samsung and the microchip maker Nvidia. The group, said to be partially based in South America, bragged about its exploits and in one ransomware attack on the Brazilian telecoms giant Claro was said to have stolen £10 million, although the company has not confirmed this. The hackers also targeted Brazil’s ministry of health, it has been reported.
Advertisement
City of London police said that officers had arrested seven people in relation to Lapsus$ attacks but would not confirm the boy’s identity.
However, the researchers and a group of hackers have previously identified the boy, who also used the screen name Breachbase.
Detective Inspector Michael O’Sullivan, from City of London police, said inquiries were continuing into the hacking group. “Seven people between the ages of 16 and 21 have been arrested in connection with this investigation and have all been released under investigation,” he said.