Last updated: 24 August 2026

GTA 6 Leak Hunt: Take-Two Subpoenas Microsoft & Discord

On August 20, 2026, Take-Two Interactive escalated its response to the "Cyberleek" GTA 6 leak by filing federal subpoenas demanding Microsoft and Discord hand over identifying records tied to the leaker. This is a separate story from the leak itself, covered in our Cyberleek leak explainer — this guide covers the legal escalation: what Take-Two is actually asking for, the DMCA mechanism it's using, and where things stand as of the most recent reporting.

01What Take-Two Filed, and When

On August 20, 2026, Take-Two Interactive filed subpoenas in the U.S. District Court for the Southern District of New York (SDNY), targeting Microsoft and Discord. The goal is to identify who's behind "Cyberleek," the alias responsible for the GTA 6 gameplay-clip and alleged-map leak that began circulating August 18.

02The Legal Mechanism: a DMCA §512(h) Subpoena

These aren't part of a lawsuit against Cyberleek — they're DMCA §512(h) subpoenas, a mechanism that lets a copyright holder compel a service provider to identify an alleged infringer's account without first filing and litigating a full copyright suit. A court clerk can issue one on request as long as the procedural requirements are met, without a judge ruling on the underlying merits first. It's a common early tool for identifying an anonymous infringer before deciding whether to pursue further legal action.

03What Take-Two Is Demanding

The two subpoenas ask for different things from each company:

• From Microsoft: device identifiers (MachineGuid/Microsoft account IDs) tied to the leaker's Windows and Xbox accounts, registration and last-login IP addresses, phone numbers, linked Google/Xbox account data, OneDrive contents, GitHub-repository data, and Microsoft's own internal investigative records on the Cyberleek persona.
• From Discord: identifying account information — IDs, registration emails, IP addresses, phone numbers, and linked accounts — for every account that was active in three specific Discord servers going back to June 1, 2026.

Both companies have until September 4, 2026 to comply.

04Precedent: This Isn't the First Time

This is a similar route to the one used after GTA 6's original 2022 source-code and footage breach, which was ultimately traced to Lapsus$ member Arion Kurtaj — then 17 — who was prosecuted in the UK under the Computer Misuse Act and given an indefinite hospital order in 2024. Cyberleek has reportedly claimed a personal connection to Kurtaj, but that claim is unverified — it comes from Cyberleek's own statement, with no independent confirmation, so don't treat it as established fact.

05What the Companies Have Said

A Discord spokesperson confirmed the subpoena on the record: "Discord sometimes receives subpoenas related to the Digital Millennium Copyright Act (DMCA). We review and comply with valid subpoenas when we receive them, as is standard and routine for companies like ours." Neither Rockstar nor Take-Two has issued a public statement beyond the court filings themselves, and Microsoft has not made any on-record comment found in reporting so far.

06Has Cyberleek Been Identified?

Not as of the most recent reporting. Rather than going quiet after the subpoena news broke, Cyberleek kept leaking — a new leak dubbed "Hypercar" was posted on August 21, which reporters noted ended speculation that the leaker had already been caught and gone silent. As of the afternoon of August 21, Rockstar reportedly still hadn't identified who's behind the account or even determined how the material was obtained in the first place.

Despite the ongoing leaks, Rockstar hasn't changed its plans for its previously scheduled "Extended Look" reveal, set to premiere on Netflix on August 27, and GTA 6 remains on track for its November 19, 2026 release.

07Legal Risk If Cyberleek Is Identified

Reporting frames the exposure as a mix of civil and potential criminal liability: civil copyright claims carry statutory damages that can run from roughly $750 to $150,000 per willfully infringed work, and if investigators determine the material came from an actual system breach rather than an insider leak, that opens the door to separate hacking or unauthorized-access charges on top of the copyright claims. Exact charges, if any, depend on how Cyberleek is ultimately identified and what the investigation finds — nothing beyond that general exposure has been confirmed.