On 24 March 2022 the City of London Police announced the arrest of seven people aged between 16 and 21 in connection with the Lapsus$ extortion group, whose named victims included Okta, Nvidia, Samsung, Ubisoft, LG and Microsoft. All seven were released under investigation. Two, aged 16 and 17, were subsequently charged with offences including unauthorised access to a computer with intent to impair the reliability of data and fraud by false representation.
Reporting described a 16-year-old in Oxford as a leading figure in the group.
Sophistication Was Never The Requirement
We filed the group’s work at 22-0120, where an identity provider was reached through its outsourced support desk, and at 22-0322. The methods were social engineering, credentials bought from people who had them, and persistence.
No novel exploit was needed for any of it. The desk states that plainly because the industry’s vocabulary — advanced, sophisticated, nation-state grade — describes the attacker’s resources rather than the defender’s gap, and the gap here was reachable by teenagers.
Publicity Was The Operating Model
Lapsus$ announced targets on Telegram, solicited insiders openly, and published as it went. That is unusual: most operations in this corpus treat visibility as a cost.
We have recorded at 22-0322 that the publicity let Microsoft interrupt an exfiltration in progress, and at 22-0627 that spectacle is sometimes the objective. Here the visibility appears to have been the point and the vulnerability at once — it produced the reputation and it produced the arrests, within weeks.
Nobody Is Named In This File
This desk names people who have been convicted, as it does at 22-1005, and withholds names otherwise. At the point recorded here, arrests and charges had been made and nothing had been proven.
Two of those charged were children. We have recorded the outcome of the process rather than the identity of anyone inside it, and it does not reproduce the online handles reported at the time, which function as names.
Compiled from contemporaneous reporting of the police announcement and subsequent charging decisions, listed below. The characterisation of a 16-year-old in Oxford as a leading figure was widely reported at the time and is carried as a reported claim, not as a finding. No individual is named and no online handle is reproduced. The list of victim organisations reflects incidents publicly attributed to the group; this desk files those separately and does not restate their figures here. Outcomes of proceedings after this date are outside the scope of this file. Graded high on the events. Corrections: corrections@forensicpost.com.