Take-Two goes to federal court to unmask the GTA 6 leaker

Take-Two filed subpoenas in federal court on Thursday, August 20, 2026, seeking to identify whoever is behind the GTA 6 gameplay leaks. The filings went in at the U.S. District Court for the Southern District of New York and target Microsoft and Discord. Both have until September 4 to hand over data.

Until now the only visible response had been copyright takedowns. This is a different order of thing.

Updated August 23. Two days after this filing, the takedowns reached further than they had before: Cyberleek’s website and Telegram channel both went down on August 22, after a seventh clip. The build itself is still out there and nobody has been identified. See the leak itself for what changed.

Updated August 31. There are four applications, not two. A second pair, against X Corp and Google over YouTube, is dated August 21, and the accounts it names are ones the GTA community had already called impostors. That is its own section below.

Updated September 1. The paperwork has moved three times since. Take-Two withdrew the YouTube application after a judge declined to sign it, filed a fifth application against Discord on August 29 that it is asking the court to seal, and retracted a copyright notice that had locked a reporter out of X over screenshots of public court orders. In its own filing the investigation is “evolving rapidly”. All three are below.

What was filed, and why those two companies

Take-Two is using a DMCA subpoena, a mechanism that lets a copyright holder compel a platform to identify users without first filing a full lawsuit. It is fast, and it is why this arrived within two days of the leaks starting rather than months later.

• Microsoft is in scope because, according to the filing, the infringing material was first posted to GitHub, which Microsoft owns.
• Discord is in scope because the material was then posted across servers by various accounts.

Discord’s response was procedural: it said it regularly receives DMCA subpoenas, reviews them, and complies with the valid ones. Microsoft has not commented.

The scope is much wider than one person

This is the part worth understanding properly, because the headlines do not carry it.

The request is not limited to the Cyberleek account. As reported, it covers every account that communicated in three named Discord servers since June 1, and asks for:

• Windows device identifiers (MachineGuid and MSA)
• Registration and last-login IP addresses
• Phone numbers
• Linked Google and Xbox accounts
• OneDrive contents referencing GTA, Rockstar or Cyberleek

If you were in one of those servers and never touched a leaked file, your identifying data is still inside the request. Whether a platform hands all of that over is a separate question, and DMCA subpoenas are frequently narrowed or challenged. But as filed, the net is server-wide.

The second wave names accounts the community called fakes

Two more applications followed at the same court, dated August 21, one day after the first pair. They target X Corp and Google, and according to TorrentFreak’s reading of the filings they were lodged by a different firm, Ruttenberg IP Law, where the Microsoft and Discord applications came from Kirkland & Ellis.

Platform	What is named	What is demanded
X Corp	Three accounts: @cyberleek_ar_io, @cyberleekario, @MrCyberLeek	Account IDs, registration emails, IP access logs, phone numbers, connected accounts, device identifiers
Google	One YouTube video, and three channels: CyberLeeks, Surfer24k, Cyberleek_ar_io	The same identifying set for the account behind the upload

The time window is the same as the first pair: June 1 onward.

Here is the part that is worth slowing down for. Those X accounts are not Cyberleek, on Cyberleek’s own account of it. The GTA community had flagged all three as impostors reposting the clips, and the later leaked videos carried a watermark reading “CYBERLEEK DOES NOT HAVE TWITTER”. Whether Take-Two believes the handles are the source, or is simply pulling the thread on everyone who spread the material, is not stated in the filings. All three accounts have since been suspended.

So the honest reading of the second wave is narrower than “Take-Two closes in on the leaker”. It is Take-Two demanding identifying data on reposters, at least on the face of the paperwork, and a DMCA subpoena does not require the platform’s user to be the original source. Judges have signed the orders directing the clerk to issue the subpoenas. As of today no data has publicly changed hands and nobody has been identified.

The paperwork has moved three times since

Between August 29 and August 31 the record changed in three ways. Only one of them points where the headlines pointed.

Take-Two withdrew the YouTube application

The application against Google is gone. Judge John P. Cronan declined to sign it without more on how those three channels connect to the video. Take-Two supplied some of that and then dropped the request anyway. Its filing:

Take-Two has determined it no longer needs the particular information requested. Thus, Take-Two respectfully withdraws its subpoena request.

It reserves the right to go back to Google later. Read that in both directions. “No longer needs” is consistent with having found the same answer elsewhere. It is equally consistent with a judge signalling the application would not survive as written. Nothing on the record says which, and the four applications are now three live ones.

A fifth application went to Discord, and Take-Two wants it sealed

On Friday, August 29, Take-Two filed against Discord again. This one is narrow where the first was server-wide. It names one additional Discord user, adds identifying information on a user already named, and asks for more on the servers from the first application.

Alongside it went a motion to keep the details under seal, on the grounds that the material

reveals highly sensitive, confidential information about an ongoing investigation into copyright infringement and the misappropriation of Take-Two’s confidential information

and that disclosing it could

compromise Take-Two’s ongoing investigation and even tip off the alleged infringers as to the nature and progress of Take-Two’s investigation.

Take-Two describes the investigation as “evolving rapidly as new information becomes available”.

This is the filing that actually changed something. The first Discord application asked for everyone in three servers, which is what you file when you do not know who you are looking for. Naming individual users and then asking the court to hide the names is what you file when you think you might. That is a change in posture, not a result. Nobody has been publicly identified, nobody has been charged, and a sealed application is by definition one nobody outside the court can check.

Take-Two hit a reporter with a copyright notice over public court records, then took it back

On August 26, Stephen Totilo of the Game File newsletter was locked out of X over a copyright notice filed on Take-Two’s behalf. The post it targeted was his August 21 report that judges had cleared the Microsoft and Discord subpoenas. What it contained was three screenshots: the two court orders, and a post by Xbox chief technology officer Scott Van Vliet saying Microsoft is “working closely with Take-Two and Rockstar Games”. No leaked footage, no gameplay, nothing from the build.

Take-Two retracted within a day of Totilo asking why. His images were restored and X told him the account was clear. Neither Take-Two nor Ebrand, the Poland-based brand protection vendor that filed the notice, has explained it.

It belongs on this page because it is the same enforcement machinery as everything above, aimed at reporting on the case rather than at the leak, and because it went out without anyone appearing to read it first. That is worth knowing when you are weighing how precisely the rest of this dragnet has been aimed.

A subpoena was never the confirmation, and then one arrived

When these filings went in, the useful point was what they did not do. Take-Two was asserting that copyrighted material of its own had been distributed. That is a strong signal about ownership and not a statement about what the footage shows or how current it is, and for six more days Rockstar neither confirmed nor denied that the clips show GTA 6.

Updated August 27. That ended on August 26, when Rockstar described the past week as “having videos of Grand Theft Auto VI gameplay leak in this way”. The footage is real, on the company’s own account of events. The distinction above still holds for everything else: the statement confirms no mechanic, no build date and no individual clip. We rate it on the leak clips being genuine and cover the statement in full on the leak itself.

The leaker was rumoured arrested, then posted again

Over the weekend, Cyberleek went roughly 24 hours without posting. That silence alone produced widespread claims that the FBI had made an arrest. There was never any confirmation from law enforcement, Rockstar or Take-Two, and no named source.

It ended the way these usually do: the account posted again. The sixth leak, a two-and-a-half minute clip showing a hypercar being taken and driven through the city, went up on August 21.

Silence is not evidence of an arrest. It is evidence of silence. Given that the same account is promoting a cryptocurrency, a quiet period followed by a dramatic return is also exactly the shape of an attention cycle.

What it did to the share price, honestly

Take-Two stock opened the week around $245 and traded near $236 on August 20. That gap has been widely reported as billions wiped off the company by the leaks.

Treat that with care. GameSpot, reporting the same numbers, points out what else was in play: chief executive Strauss Zelnick sold about $10 million of shares, and the company’s recent quarter showed a loss of more than $30 million with net bookings down 3%.

The Zelnick sale is worth being precise about, because “chief executive dumps $10 million as leaks hit” is a sentence that writes itself. Take-Two’s Form 4 filings record it as eleven separate fills on a single day, August 10, 2026, totalling 40,000 shares for about $10.1 million, at prices between $250.49 and $255.12. Two things follow from that. A round share count executed in pieces inside a five-dollar band is one order being worked through the market rather than eleven decisions. And August 10 is eight days before the leaks began, so it cannot have been a reaction to them.

A readable breakdown of those same filings is on FilingIQ (login required), which scores and parses them from the raw Form 4 data. Disclosure: FilingIQ is run by this site’s operator.

A share price is not a damage estimate for one event, and anyone presenting it as a clean measurement of leak harm is doing arithmetic the market did not do.

The week since makes the point better than we could. Reporting has the stock around $248 before the leaks spread on August 18, at an intraday low near $232, and back near $240 by August 21, ahead of the Extended Look. Those are quoted figures from financial coverage rather than our own market data, and the exact numbers move with which day and which price you pick. The shape is the part that matters: a drop that was reported as billions destroyed had recovered a good share of itself inside three trading days, while the leaks were still going. Whatever the market was pricing, it was not a permanent loss.

Nothing has moved on the release

November 19, 2026 is unchanged, and Take-Two has not revised any guidance. The Extended Look aired on schedule on August 27, giving Rockstar 26 minutes and 49 seconds of its own footage to put in front of the leaked kind. Nothing in any of the filings has touched the release plan.

Sources

• variety.com: Rockstar subpoenas Microsoft, Discord for data
• pcgamer.com: Take-Two kicks off the leaker hunt with subpoenas
• tomshardware.com: subpoenas for device IDs of everyone in three Discord servers
• forbes.com: the leaker is leaking again, ending rumours of being caught
• torrentfreak.com: Take-Two expands the leak hunt with DMCA subpoenas to X and YouTube
• torrentfreak.com: the probe is “rapidly evolving”, and Take-Two wants the new Discord demands under seal
• shacknews.com: a second Discord subpoena, with the details asked to remain sealed
• pcgamer.com: Take-Two asks the court to keep the latest request sealed
• gamefile.news: Stephen Totilo on the notice that locked him out, and the retraction
• deltiasgaming.com: Take-Two subpoenas Google and X
• gamespot.com: Take-Two loses billions in market value since the leaks began
• finbold.com: how much Take-Two stock is down since the GTA 6 leaks
• techloy.com: the leaks hit the stock, then it bounced