Lapsus$ Linked to Teen Suspects After Microsoft, Nvidia, Okta, and Globant Breaches

U.K. police arrested seven people aged 16 to 21 over suspected links to Lapsus$, the extortion-focused hacking group tied to intrusions at Microsoft, Nvidia, Samsung, Ubisoft, Okta, and other major firms. Reporting identified a 16-year-old near Oxford as a suspected central figure, while investigators and journalists described the group as a loose set of mostly young operators who stole data, leaked source code and internal documents, and taunted victims publicly on Telegram and other platforms. Microsoft confirmed the group obtained source code through limited access, reinforcing the scale and credibility of the campaign.

The activity continued to expand as Globant disclosed unauthorized access to a limited portion of its code repository after Lapsus$ leaked 70GB of allegedly stolen data. The company said the exposed material appeared limited to certain source code and project documentation for a small number of clients, and that it had not found evidence of broader compromise. Coverage of the group highlighted that its operators often relied on comparatively simple but highly effective tactics—including social engineering, SIM swapping, MFA fatigue attacks, and attempts to bribe insiders—showing how basic intrusion methods enabled a string of high-profile breaches and data leaks.