If you thought the GTA 6 leaks drama was dying down now that Rockstar’s official Extended Look has dropped and the marketing machine is rolling, think again. Take-Two Interactive has officially filed a second Discord subpoena as part of its ongoing investigation into the Cyberleek leaks — and this time, they’ve asked the court to keep the details completely under seal. The hunt is very much still on.
What Happened With the GTA 6 Cyberleek Leaks?
To understand where we are now, here’s a quick recap of how all of this started. On August 18, 2026 — just nine days before Rockstar’s carefully staged Netflix Extended Look — an anonymous individual or group calling themselves Cyberleek began posting what appeared to be genuine GTA 6 gameplay footage online. The leaks spread across social media platforms like wildfire, racking up millions of views through reuploads before Take-Two could issue DMCA takedowns.
The footage itself was damning in its authenticity. One clip showed protagonist Jason Duval at home playing a solo basketball mini-game, complete with a modified HUD showing new game mechanics. Another showed Jason driving on a highway, escalating a police situation through a six-star wanted level system. Even more jaw-dropping, one clip had Jason shooting the word “LEEK” into a wall using bullet holes — a deliberate taunt suggesting Cyberleek had access to a fully playable build of the game, not just stolen video files.
Additional details spotted across the leaked footage included stealth mechanics, vehicle health and fuel gauges, RPG-style stamina systems, in-game licensed radio stations, police identification icons, and what looked like an internal game store selling fictional consoles and electronics — one of which appeared to parody PlayStation.
The leaks thankfully stopped short of story spoilers, which had been a major fear throughout the community. But the damage to Rockstar’s carefully managed reveal strategy was done.
Who Is Cyberleek?
The honest answer is: nobody knows yet, and that’s the entire reason this investigation is still ongoing. Cyberleek’s real identity remains unconfirmed. It’s unclear whether it’s one person, a group, or multiple unrelated actors attempting to capitalize on the same campaign. What is clear is that they had access to a recent, playable build of the game — and a very specific set of demands.
Cyberleek published what they called the CYBERLEEK Edict — a manifesto framing the leaks as a protest against digital pre-orders, paid content gating, “fake” single-player DLC, and games becoming unplayable after server shutdowns. The manifesto borrowed heavily from consumer-advocacy language, even invoking the same concerns championed by Stop Killing Games, the campaign founded after Ubisoft’s shutdown of The Crew. Stop Killing Games publicly condemned the leaks as illegal and harmful, distancing themselves from Cyberleek entirely.
Alongside the manifesto, Cyberleek launched a Solana-based memecoin called $CYBERLEEK, claiming funds would go toward a “secret project” and protection against corporate retaliation while insisting, with all the credibility of a used car salesman, that it was “not a cash grab.” The coin exploded in value by over 1,400% amid the viral attention, with the market cap climbing to around $22 million at its peak — raising very pointed questions about whether the anti-corporate protest narrative was ever the real point. Kotaku reported that Cyberleek was also encouraging people to vote on which footage to leak next by sending tokens to their preferred option, turning the whole thing into a grotesque gamified leak-lottery funded by their own community.
Take-Two’s Legal Response — Fast and Aggressive
Take-Two moved quickly. Within days of the leaks surfacing, the publisher filed DMCA subpoenas in the U.S. District Court for the Southern District of New York, demanding user data from Microsoft and Discord. The subpoenas required both platforms to produce account IDs, registration emails, IP addresses, phone numbers, linked accounts, and internal investigative records associated with the Cyberleek persona — all by a September 4, 2026 deadline.
Xbox CTO Scott Van Vliet publicly confirmed that Microsoft is cooperating with Take-Two and Rockstar, posting that the company is working to protect their creative work and intellectual property. Discord also responded through their spokesperson, confirming they routinely review and comply with valid subpoenas under DMCA.
Take-Two also filed subpoenas with X (formerly Twitter) to identify users tied to the leaks on that platform — though Cyberleek had publicly stated they had no official Twitter presence, meaning many accounts amplifying the leaks on X were likely imposters cashing in on the attention.
The Second Discord Subpoena — Sealed and Targeted
Now, as reported by Torrent Freak, Take-Two has filed a second subpoena with Discord — and this one is significantly different from the first. While the details of the initial subpoena were publicly available, the second has been filed with a specific request to be kept under seal, meaning the Discord servers and users being investigated are not available to the public.
Take-Two’s initial filing does reveal that the company has “identified one additional Discord user” and also obtained additional identifying information on a previously identified user, as well as more targeted information concerning the community servers flagged in the first subpoena. In other words — they’re closing in, and they don’t want whoever is behind this to know how close.
The publisher argues that keeping the second subpoena sealed from public view is absolutely necessary, stating that “public disclosure of this information could compromise Take-Two’s ongoing investigation and even tip off the alleged infringers as to the nature and progress of Take-Two’s investigation and information Take-Two has gathered about the infringement.” They specifically warned that making details public risks the infringers deleting, destroying, or concealing evidence of their activities to evade identification.
Take-Two’s official characterization of the investigation is that it is “rapidly evolving and ongoing” — language that signals this is not cooling down, but heating up.
YouTube Subpoena Withdrawn — But That’s Actually Good News for the Investigation
In a separate but notable development, Take-Two has also withdrawn its previous subpoena request to YouTube regarding three users allegedly linked to one of the leaked videos. The company’s reasoning? It “no longer needs” the information.
That phrasing is doing a lot of heavy lifting. When a legal team pursuing an active investigation says they no longer need information they previously requested from a major platform, it typically means one of two things — either they’ve found a better source for that information elsewhere, or the trail led to a dead end. Given the broader context of the investigation ramping up with a second Discord subpoena, the more likely read is the former. Take-Two may have obtained what it needed through other channels.
Rockstar Called the Leaks “Heartbreaking”
Before diving further into the legal mechanics, it’s worth acknowledging the human cost of all this. On August 26, 2026 — one day before the official Netflix Extended Look — Rockstar Games issued a public statement directly addressing the Cyberleek situation.
The developer described having gameplay videos leak in this way as “heartbreaking for our team”, adding that it was “obviously not how we intended for you to see the game after all this time.” Rockstar also apologized to fans for how long development has taken, confirming the game is nearly finished and that the November 19 release date holds firm. They asked fans to avoid spoilers and wait to experience the game properly at launch.
It’s the second time this has happened to Rockstar. Back in 2022, a then-18-year-old hacker named Arion Kurtaj — operating while under police protection at a Travelodge hotel, using only a television, an Amazon Fire Stick, and a phone — breached Rockstar’s systems and leaked 90 early GTA 6 clips. Rockstar stated that hack cost the company $5 million. Kurtaj was later sentenced to an indefinite secure hospital order. Timing note: he has since been moved to a regular prison ahead of a retrial scheduled for November 2026 — the same month GTA 6 launches.
Where Does This Leave GTA 6?
Despite everything, GTA 6 is still on track for November 19, 2026, on PS5 and Xbox Series X/S. Rockstar’s Extended Look premiered on Netflix on August 27 as planned, giving fans their first official, sanctioned, gorgeous look at protagonists Jason and Lucia, Vice City, and the game’s mechanics — a look that, for most players, far eclipsed the watermarked, low-quality Cyberleek footage in both quality and emotional impact.
Rockstar has been busy on multiple fronts as launch approaches, and with new screenshots of Jason and Lucia already dropping and a full marketing push ramping up, the next few months are going to be intense for GTA 6 fans. The leaks haven’t killed the hype — if anything, they may have accelerated it.
What they have absolutely done, though, is set in motion a legal investigation that Take-Two clearly has no intention of abandoning. The sealed second Discord subpoena, the withdrawal of the YouTube request, and the “rapidly evolving” language all point to a publisher that believes it’s getting close to identifying who Cyberleek really is.
The Bigger Picture — Game Security in 2026
The Cyberleek situation has put a spotlight on something the games industry has been quietly anxious about for years: how do you protect the most anticipated games in history from internal or external leaks when development spans over a decade and involves thousands of people?
The 2022 Rockstar breach and this 2026 Cyberleek incident are two very different types of events — one was a network hack, the other appears to involve a playable build acquired through means that are still unclear. What they share is the devastation they cause to development teams who have spent years carefully crafting an experience, only to watch pieces of it get scattered across the internet without context or quality.
The gaming community loves a good viral moment, and leaks feed that appetite. But there’s a real human cost behind every one of them that rarely gets enough attention. Gaming culture celebrates creators — and watching those creators describe their life’s work being exposed without permission as “heartbreaking” should carry weight.
Take-Two’s investigation is far from over. And with a November 19 launch on the horizon and Cyberleek apparently still within legal reach, this story has a few more chapters left in it.
What to Watch For Next
- September 4, 2026: The original deadline for Microsoft and Discord to comply with the first subpoena requests
- Sealed second Discord subpoena results: Take-Two has identified additional users — any arrest or identification announcement would be the next major development
- Whether Cyberleek releases more footage: The leaks have slowed significantly, but the group has not publicly stated they’re done
- November 19, 2026: GTA 6 launches on PS5 and Xbox Series X/S — assuming servers cooperate on launch day
Stay tuned. This one’s far from over.
