Take-Two Interactive has taken its GTA 6 leak response to federal court. On August 20, the publisher filed DMCA subpoenas in the U.S. District Court for the Southern District of New York, compelling both Microsoft and Discord to hand over detailed user data tied to the “CyberLeek” persona responsible for a string of GTA 6 gameplay leaks that started on August 18. Both companies have until September 4, 2026 to comply — roughly two weeks from the filing date.
This is now simultaneously a copyright case, a platform accountability test, and a cryptocurrency scheme investigation. Here’s the full breakdown of what’s been leaked, what Take-Two is demanding, and why this matters beyond GTA 6.
Who Is CyberLeek and What Have They Leaked?
CyberLeek is a persona — or group of individuals operating behind a persona — that began publishing GTA 6 gameplay footage on August 18, 2026. As of writing, seven leaked videos have been released across three days. The footage includes:
- Gameplay showing co-protagonist Jason driving a supercar through Vice City
- Footage of Jason shooting the word “leek” into a wall — suggesting direct playable access to a working GTA 6 build rather than pre-rendered captures
- Map details and never-before-seen locations in Vice City
- New mechanics and gameplay systems not previously revealed by Rockstar
The “leek” message shot into a wall is the most significant detail forensically. It’s the kind of thing someone does when they have real-time control over a game build — not when they’re playing back a pre-recorded file or re-encoding existing footage. Multiple outlets have concluded it points to CyberLeek or an associate having a playable development build of GTA 6, which would represent a significantly more serious breach than the 2022 GTA 6 leak that came from a hacked internal Slack.
CyberLeek has publicly framed the leaks as a protest against publisher practices — specifically GTA 6’s digital-only launch strategy, the absence of a disc on release day, and broader complaints about paywalled content and predatory DLC. The group published a manifesto on a dedicated website presenting the leaks as activism on behalf of gamers. The reality behind that framing is considerably messier.
The Cryptocurrency Angle — Why This Isn’t Really About Gamers’ Rights
Alongside the leaks, CyberLeek has been aggressively promoting a $CYBERLEEK meme coin. The mechanism: people buy the coin, the coin’s value rises, and CyberLeek uses the number of holders as a metric to “vote” on which new footage gets leaked next. The group has described the cryptocurrency operation as funding “a secret project.”
Polygon’s investigation found evidence strongly suggesting the arrangement is structured to benefit CyberLeek financially. The group holds a significant portion of the coin supply, meaning that every time coverage of the leaks drives new buyers into $CYBERLEEK, the group’s own holdings increase in value. It’s a pump scheme wrapped in the language of protest — the leaks generate media attention, the attention drives coin purchases, the purchases enrich whoever is holding the supply. The “gamers’ rights” framing is the marketing campaign for a financial instrument.
This context is important for understanding Take-Two’s legal approach. The subpoenas explicitly state the data will only be used to protect Take-Two’s copyright rights, but a group profiting from the leak through cryptocurrency faces significantly more exposure than someone who simply posted footage out of fandom frustration.
The DMCA Subpoena Mechanism — How This Works Legally
Take-Two is using a specific legal tool: the DMCA subpoena, which allows a copyright holder to compel a platform to identify an alleged infringer without first filing a full lawsuit. It’s a faster, lower-threshold mechanism than standard civil litigation — the rights holder files with a court, demonstrates a sworn declaration that the purpose is identifying infringers to protect copyright, and the court issues an order requiring the platform to comply.
Importantly, this is not a criminal proceeding. Take-Two is pursuing civil copyright enforcement. The DMCA subpoena route was also used in the original 2022 GTA 6 leak — a then-17-year-old hacker named Arion Kurtaj was eventually identified, prosecuted under the UK Computer Misuse Act alongside other Lapsus$ hacking activity, and sentenced to indefinite detention in a secure psychiatric facility. Whether CyberLeek’s situation leads anywhere near similar territory depends entirely on where they’re located and what laws apply.
What Take-Two Is Demanding From Microsoft
The Microsoft subpoena is substantial. GTA 6 footage was apparently posted to Microsoft’s GitHub developer platform, which gave Take-Two a hook into the Microsoft legal relationship. The filing demands Microsoft produce by September 4:
- All internal Microsoft business records and investigative records related to Microsoft’s own internal investigation of the CyberLeek persona
- Account IDs and registration details for accounts linked to CyberLeek
- Registration and login IP addresses
- Associated phone numbers
- Device identifiers — specifically MachineGuid and Microsoft Account identifiers that fingerprint individual computers
- Any linked Xbox accounts and linked Google accounts
- OneDrive content referencing GTA, Rockstar, or CyberLeek
- Device and telemetry records showing whether certain files or tools appeared on associated devices
The MachineGuid request is particularly interesting. MachineGuid is a Windows registry value that uniquely identifies a specific PC installation — it’s one of the fingerprinting mechanisms Windows uses internally. If CyberLeek accessed their Microsoft account from the same machine they used to play or capture the GTA 6 build, that telemetry creates a link between the account and the device. Combined with login IP addresses, it could narrow down identity significantly even if the account itself was created with fake details.
What Take-Two Is Demanding From Discord
The Discord subpoena covers a broader net. Take-Two is demanding identifying information for all users who were members of specific Discord servers connected to the leaks, covering the period from June 1, 2026 to the present. The named servers and personas include:
- CYBERLEEK
- CINEMATICROCKSTAR
- Surfer24K
- cyberleek_west
- surwest
- Ødyssey.gg
- DarkViperAU (notably a known GTA content creator whose server apparently had some connection to communications around the leaks)
From Discord, Take-Two wants email addresses, phone numbers, IP addresses, device identifiers, and telemetry records tied to leaked file artifacts for all accounts that communicated in those servers during the covered period. That’s a significant dragnet — potentially encompassing many people who discussed the leaks without having anything to do with producing them. Discord confirmed to Variety that it receives DMCA subpoenas and reviews them per its legal obligations but did not comment specifically on this filing.
Take-Two’s Market Impact — $2.8 Billion Lost
The leaks haven’t just been a PR headache. Take-Two’s stock dropped sharply in the days following the first leak on August 18, with the company losing approximately $2.8 billion in market capitalisation across the leak period. For context, GTA 6 pre-orders are already tracking as one of the strongest in gaming history — the game is projected to generate over $10 billion in its first year — so any uncertainty around the launch or the game’s content reaching the public prematurely carries real financial stakes. The aggressive legal response is proportionate to those stakes.
CEO Strauss Zelnick’s earlier comments that he wasn’t concerned about the Rockstar union legal battle impacting GTA 6 sales look somewhat different now that the company is simultaneously dealing with an active federal copyright enforcement action, a market cap hit, and a leak group that appears to have a working build of the game two months before its November 19 release.
What Happens Next
Microsoft and Discord have until September 4 to produce the requested data. After that, Take-Two’s legal team will have whatever the platforms hand over and can use it to identify individuals for potential civil claims, or refer findings to law enforcement if criminal activity is evident. Whether CyberLeek is one person or a group, whether they’re inside or outside the US, and whether they obtained the build through a hack or an internal leak will all determine what legal exposure actually looks like.
Rockstar has not commented on the leaks publicly. The game still launches November 19, 2026 — and GTA 6 pre-orders, despite the market cap impact on Take-Two’s stock, remain among the strongest in PlayStation Store history. The leaks have generated enormous traffic and conversation, but whether that translates to any meaningful impact on launch sales is a question the November numbers will answer.
For more on the GTA 6 situation, the Rockstar union workers have separately asked fans not to boycott GTA 6 and instead support their legal fight ahead of the September tribunal — a different legal front for the same studio. The Xbox Series X25 25th anniversary console also leaked pricing this week in an entirely different kind of leak — the $899.99 figure came from Dealabs rather than a federal court filing. And if you’re looking for something to actually play while all this legal drama unfolds, the Modern Warfare 4 open beta goes live August 28 for everyone — no pre-order required.
