CyberLeek’s GTA VI Leak Prompts Take-Two Subpoenas as Access Path Remains Unclear
Summary
CyberLeek posted unreleased GTA VI footage, prompting Take-Two to seek subpoenas for account identities. The access path remains unclear; experts say insider access or stolen build data are possibilities, while crypto-linked monetization suggests financial motives.
Key points
- The online persona CyberLeek posted unreleased Grand Theft Auto VI gameplay footage before the planned reveal.
- The article says the leak may have involved direct access to Rockstar Games systems or proprietary data supplied by an insider; the access path is not established.
- Take-Two sought DMCA subpoenas against Discord, Google, Microsoft and X for identifying information; judges granted the requests against Discord, Microsoft and X, while the Google request remained pending.
- Katie Moussouris said the Discord request sought device identifiers, login records and cloud storage contents for people connected to three servers, going back to June.
- Leaked-video watermarks linked to crypto wallets, and CyberLeek reportedly promoted a token and offered ad space on future leaks, alongside its stated protest motive.
- As of Monday, websites used by those behind CyberLeek to post leaks and links to a memecoin were offline, while new footage had continued to appear.
Article Details
- Victim Organization
- Rockstar Games
- Incident Type
- Suspected theft or unauthorized disclosure of pre-release game material, followed by public leaks and monetization efforts.
- Data Types Exposed
- Pre-release gameplay footage
- Proprietary game build data (possible; the source says the leaker may have accessed an actual build)
- Operational Impact
- Gameplay footage continued to appear online, prompting a high-profile investigation and legal action by Take-Two Interactive. The source reports no system outage or other operational disruption.
- Ransom Or Extortion
- The CyberLeek persona reportedly monetized the leaks through cryptocurrency-related promotions and offered advertising space on future leaks. The source does not report a conventional ransom demand or payment.
- Claim Status
- alleged
People
Ben BernsteinHuntress cybersecurity advisor who characterized the CyberLeek manifesto and monetization activity.Cynthia KaiserHalycon ransomware research center executive who commented on the leaked material, monetization, and parallels with ransomware pressure tactics.Katie MoussourisLuta Security founder and CEO who discussed the monetization model and the scope of Take-Two's subpoena.Zach EdwardsInfoblox threat researcher who discussed the authenticity of the leaked material and the possibility of insider access.