Last updated: 5 September 2026

GTA 6 Leak Hunt: Take-Two Subpoenas Microsoft & Discord

On August 20, 2026, Take-Two Interactive escalated its response to the "Cyberleek" GTA 6 leak by filing federal subpoenas demanding Microsoft and Discord hand over identifying records tied to the leaker. This is a separate story from the leak itself, covered in our Cyberleek leak explainer — this guide covers the legal escalation: what Take-Two is actually asking for, the DMCA mechanism it's using, and where things stand as of the most recent reporting.

01What Take-Two Filed, and When

On August 20, 2026, Take-Two Interactive filed subpoenas in the U.S. District Court for the Southern District of New York (SDNY), targeting Microsoft and Discord. The goal is to identify who's behind "Cyberleek," the alias responsible for the GTA 6 gameplay-clip and alleged-map leak that began circulating August 18.

02The Legal Mechanism: a DMCA §512(h) Subpoena

These aren't part of a lawsuit against Cyberleek — they're DMCA §512(h) subpoenas, a mechanism that lets a copyright holder compel a service provider to identify an alleged infringer's account without first filing and litigating a full copyright suit. A court clerk can issue one on request as long as the procedural requirements are met, without a judge ruling on the underlying merits first. It's a common early tool for identifying an anonymous infringer before deciding whether to pursue further legal action.

03What Take-Two Is Demanding

The two subpoenas ask for different things from each company:

• From Microsoft: device identifiers (MachineGuid/Microsoft account IDs) tied to the leaker's Windows and Xbox accounts, registration and last-login IP addresses, phone numbers, linked Google/Xbox account data, OneDrive contents, GitHub-repository data, and Microsoft's own internal investigative records on the Cyberleek persona.
• From Discord: identifying account information — IDs, registration emails, IP addresses, phone numbers, and linked accounts — for every account that was active in three specific Discord servers going back to June 1, 2026.

Both companies had until September 4, 2026 to comply. That deadline has now passed, and as of this writing there's no public confirmation that either company has produced records, moved to quash the subpoenas, or otherwise responded — the compliance status is simply unknown from the outside.

A day after the initial filings, Take-Two also applied for DMCA subpoenas against X Corp. and Google (which owns YouTube), broadening the hunt beyond Microsoft and Discord. Then on August 28, it went back to court for a second Discord subpoena — this one filed under seal specifically to avoid tipping off the people it's targeting — after saying its investigation had identified one additional Discord account of interest and gathered more information tied to a previously identified one.

04Precedent: This Isn't the First Time

This is a similar route to the one used after GTA 6's original 2022 source-code and footage breach, which was ultimately traced to Lapsus$ member Arion Kurtaj — then 17 — who was convicted by a jury in August 2023 on charges including unauthorized computer access under the UK's Computer Misuse Act, blackmail, and fraud, and was given an indefinite hospital order on December 21, 2023 (not 2024, as this and other roundups have sometimes stated). Cyberleek has reportedly claimed a personal connection to Kurtaj, but that claim is unverified — it comes from Cyberleek's own statement, with no independent confirmation, so don't treat it as established fact.

05What the Companies Have Said

A Discord spokesperson confirmed the subpoena on the record: "Discord sometimes receives subpoenas related to the Digital Millennium Copyright Act (DMCA). We review and comply with valid subpoenas when we receive them, as is standard and routine for companies like ours." Neither Rockstar nor Take-Two has issued a public statement beyond the court filings themselves, and Microsoft has not made any on-record comment found in reporting so far.

06Has Cyberleek Been Identified?

No, not as of the most recent reporting. Rather than going quiet after the subpoena news broke, Cyberleek kept leaking — a new leak dubbed "Hypercar" was posted on August 21, and further clips (including a "Lucia-led prologue" video decided by a fan poll tied to Cyberleek's own memecoin) continued to surface into early September. A Discord user going by "stayonthegrindd" has emerged in reporting as a likely suspect connected to the leaks, but investigators themselves describe this as a lead they're still chasing down, not a confirmed identification — Cyberleek has not been formally unmasked, arrested, or charged as of this writing.

Despite the ongoing leaks, Rockstar didn't change its plans for its previously scheduled "Extended Look" reveal — it premiered on Netflix as planned on August 27, 2026 — and GTA 6 remains on track for its November 19, 2026 release.

07Legal Risk If Cyberleek Is Identified

Reporting frames the exposure as a mix of civil and potential criminal liability: civil copyright claims carry statutory damages that can run from roughly $750 to $150,000 per willfully infringed work, and if investigators determine the material came from an actual system breach rather than an insider leak, that opens the door to separate hacking or unauthorized-access charges on top of the copyright claims. Exact charges, if any, depend on how Cyberleek is ultimately identified and what the investigation finds — nothing beyond that general exposure has been confirmed.