Someone out there has a six-star wanted level right now — and this time the cops are federal lawyers. Take-Two Interactive, the parent company of Rockstar Games, has filed DMCA subpoenas in a federal district court demanding that both Microsoft and Discord hand over all identifying information connected to the GTA 6 leaker known as CyberLeek. Both companies have until September 4, 2026 to comply.
The subpoenas were filed on August 20 in the U.S. District Court for the Southern District of New York, and a judge approved the requests just one day later — a remarkably fast turnaround that tells you everything about how seriously Take-Two is treating this. GTA 6 launches on November 19, 2026, and three days of continuous leaks of what appears to be a playable build of the game isn’t something Rockstar is going to sit on.
What Take-Two Is Actually Demanding
The scope of what Take-Two wants is pretty sweeping. The subpoena filed against Microsoft asks for all internal business and investigative records related to Microsoft’s own investigation of the CyberLeek persona. That includes:
- Account IDs and registration emails tied to the persona
- Registration and last-login IP addresses
- Phone numbers and device identifiers (including MachineGuid/MSA codes)
- Linked Xbox and Google accounts
- Any OneDrive content referencing GTA, Rockstar, or CyberLeek
- Device and telemetry records linked to leaked file artifacts
The Discord subpoena casts an even wider net. Take-Two is demanding identifying information for every single account that was a member of specific Discord servers between June 1, 2026 and now. The named servers and handles include CyberLeek, CinematicRockstar, Surfer24K, Odyssey, and others. For each account, Take-Two wants: account IDs, registration emails, IP addresses, phone numbers, linked connections, registration timestamps, device identifiers, and original message logs.
The scope of the Discord demand in particular is striking. Take-Two isn’t just targeting CyberLeek themselves — they’re pulling data on every person who was in those servers during that window. That’s a wide dragnet, and it could sweep in people who were simply watching or discussing the leaks rather than involved in producing them.
Xbox’s CTO Scott Van Vliet publicly confirmed that Microsoft is cooperating, posting on X that the company is “working closely with Take-Two and Rockstar Games to support efforts to protect creative content.” Discord confirmed the subpoena’s validity through a spokesperson and said it reviews and complies with valid DMCA subpoenas as “standard and routine for companies like ours.”
Who Is CyberLeek and What Have They Actually Leaked?
CyberLeek surfaced on August 18, 2026, with what appears to be genuine gameplay footage and map data from an in-development build of GTA 6. The clips that have been circulating show co-protagonist Jason Duval driving supercars through Vice City, the game’s Honor system in action, interior environments, combat, and — most tellingly — Jason shooting the word “LEEK” into a wall with bullet holes. That last one is not the kind of thing you can fake with video editing. It strongly suggests CyberLeek has actual playable access to the game, not just pre-rendered footage.
By the time Take-Two filed its subpoenas, seven leaked videos had dropped across three days, and more were being threatened. The leaked content included alleged footage of the full Leonida state map — arriving nine days before Rockstar’s own planned Netflix extended look at the game on August 27. Rockstar’s meticulously controlled rollout of GTA 6 information has been getting systematically torpedoed.
A second group also surfaced claiming to have obtained an April 2026 internal build via a phishing attack on a Rockstar employee. Whether that’s credible or opportunistic is unclear, but it adds to how chaotic the situation has become.
The Crypto Angle Is What Makes This So Messy
Here’s where CyberLeek stops being a straightforward leak situation and starts looking like something else entirely. Every piece of leaked content has been watermarked with QR codes and URLs directing viewers to CyberLeek’s website. On that site, alongside a manifesto about gamers’ rights, is a pitch: buy the $CYBERLEEK meme coin on Solana.
The coin’s supposed purpose is to fund a “secret project” directed toward “the infrastructure needed to strike, as well as the security and protection required to withstand the inevitable corporate counterattacks.” CyberLeek has also set up a private Discord where holders of the token can vote on which clip gets leaked next — essentially turning stolen Rockstar content into a reward mechanism for crypto buyers.
Reports indicate that around $11.8 million worth of the token was traded during the peak of the leak frenzy. That’s a significant amount of money flowing into a coin controlled by anonymous operators with no stated accountability, no identifiable project, and no verifiable plan for what happens to the funds.
The structure — generate massive hype by attaching your coin to the biggest gaming event of the year, get people to buy in at peak attention, profit when the price is high — looks very much like a textbook pump-and-dump scheme. Whether it is one is something investigators will presumably get to ask CyberLeek directly if Take-Two’s legal hunt succeeds.
The Manifesto Sounds Legitimate Until You Read It Carefully
CyberLeek has framed everything as a protest movement. The “CYBERLEEK Edict” lists three commandments: no digital pre-orders for games that can’t sell out, no DLC built from content already on the disc you paid for, and mandatory offline patches when servers shut down so single-player games remain playable. These are all positions that have genuine support in the gaming community and are the basis of legitimate advocacy like the Stop Killing Games movement.
The problem is that Stop Killing Games has publicly and explicitly rejected any association with CyberLeek. Stop Killing Games criticized the campaign directly, saying: “The reason he is leaking GTA 6 is his meme coin, this is all but helpful,” and warned people “do not send any money to CyberLeek.” That’s about as clear a distancing as you can get from the most prominent consumer-rights organization in gaming.
It’s also worth noting that GTA 6 not being released on physical disc is part of CyberLeek’s stated motivation — a complaint that has genuine legs given the broader industry context, with Sony announcing it will stop producing discs in 2028 and multiple major releases shipping disc-in-box with download codes rather than actual game data. The frustration is real. What CyberLeek is doing with it is the problem.
What Happens Next Legally?
The DMCA subpoena mechanism Take-Two has used is a well-established legal tool that lets copyright holders demand identifying data from platforms without first filing a full lawsuit. It’s designed precisely for situations like this — where the identity of an infringer is unknown and the platform holding that data is the only route to finding them.
Both Microsoft and Discord have until September 4 to produce the requested information. After that, Take-Two will presumably know considerably more about who is actually behind the CyberLeek persona than they do now. Whether that leads to a named defendant, a lawsuit, or worse depends on what that data contains and where it points.
The previous major GTA leak — the 90-video dump in 2022 by a hacker connected to the Lapsus$ group — resulted in Arion Kurtaj, an 18-year-old from Oxford, being sentenced to an indefinite hospital order after being found criminally responsible. That case took years and the perpetrator was in the UK, which complicated jurisdiction. This one is being pursued through U.S. federal courts and involves cooperation from two major American tech companies. The legal architecture is a lot cleaner this time.
The Bigger Picture for GTA 6
GTA 6 is still on track for its November 19 launch on PS5 and Xbox Series X/S — Take-Two has reportedly confirmed the date directly to Sony and Microsoft. The Netflix extended look is still scheduled for August 27. Rockstar is continuing to operate as if the controlled rollout is proceeding, even as clips from what appears to be their actual game circulate freely online.
The leaked footage has cost Take-Two in other ways too. Reports suggest the company lost significant market cap in the days following the initial leak, as investor confidence in Rockstar’s ability to control its own launch narrative took a hit. Whether the leaks ultimately affect consumer interest is less clear — GTA 6 was already one of the most anticipated games in history, and leaked footage of it being genuinely impressive might not hurt as much as Take-Two fears. But that’s not really the point. The point is that Rockstar spent years building a specific way of revealing this game, and someone is systematically dismantling it for crypto profits.
The full legal situation is still developing, and there’s a lot happening in gaming publishing right now that connects to similar tensions around ownership and control. For more context on how studios and publishers are navigating the current climate, check out what’s happening with Double Fine’s fight to own its own games after the Xbox split, or the questions around how Blood of Dawnwalker’s console performance decisions are landing with the community ahead of its September launch.
September 4 is the deadline. After that, we’ll know a lot more about who CyberLeek actually is — and whether that knowledge comes with consequences.
