Rockstar Games and Take-Two Interactive: GTA 6 leak hunt could expose data belonging to thousands of Discord users

GTA 6 Leak Investigation: Take-Two Targets Discord Servers in Data Hunt

Take-Two Interactive, the publisher behind Grand Theft Auto (GTA), is pursuing legal action to uncover the source of a recent GTA 6 leak. On August 20, the company issued subpoenas to Microsoft and Discord, demanding extensive user data including IP addresses, phone numbers, linked accounts, and device identifiers from members of three Discord servers dating back to June 1.

The leak originated on August 17, when an account named CyberLeek posted unreleased GTA 6 footage and a portion of the game’s map. The leaker framed the act as an ideological protest, demanding that publishers stop releasing digital-only games, cease locking single-player content behind paywalls, and commit to preserving single-player modes. CyberLeek also issued a warning to game publishers: "Behave, or be the next target."

Alongside the leaks, CyberLeek launched a Solana-based cryptocurrency token, $CYBERLEEK, which it promoted as a voting mechanism for future leaks. Critics accused the group of using the hype to inflate the token’s value, though CyberLeek later "burned" its holdings erasing the tokens while retaining the ability to collect trading fees, which reportedly reached $60,000.

Among those caught in Take-Two’s data sweep is DarkViperAU, an Australian GTA 5 streamer whose Discord server was subpoenaed. He denied involvement, stating he had no knowledge of the leak. Microsoft and Discord have until September 4 to comply, potentially exposing identifying details of hundreds or thousands of users with no direct connection to the incident.

This is not the first cybersecurity incident for Take-Two. In April, the ShinyHunters hacking group stole 78.6 million Rockstar records by targeting Anodot, a third-party analytics vendor with access to persistent authentication tokens. The breach followed a September 2022 leak of GTA 6 footage, underscoring the franchise’s recurring vulnerability to unauthorized disclosures.

The leaks have also fueled scams, with fraudsters exploiting interest in GTA 6 to distribute malware, phishing links, and fake early-access offers. Security researchers recently identified malicious sites impersonating GTA 6 demos, designed to steal passwords and cryptocurrency. The game is set for release in November on consoles, with a PC version expected later.

Source: https://www.malwarebytes.com/blog/privacy/2026/08/gta-6-leak-hunt-could-expose-data-belonging-to-thousands-of-discord-users

Take-Two Interactive cybersecurity rating report: https://www.rankiteo.com/company/take-2-interactive-software-inc-

Rockstar Games cybersecurity rating report: https://www.rankiteo.com/company/rockstar-games

"id": "TAKROC1787653455",
"linkid": "take-2-interactive-software-inc-, rockstar-games",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Video Game Publishing',
                        'location': 'Global',
                        'name': 'Take-Two Interactive',
                        'size': 'Large',
                        'type': 'Company'},
                       {'location': 'Global',
                        'name': 'Discord Server Members',
                        'size': 'Hundreds/Thousands',
                        'type': 'Users'},
                       {'industry': 'Content Creation',
                        'location': 'Australia',
                        'name': 'DarkViperAU',
                        'size': 'Individual',
                        'type': 'Individual (Streamer)'}],
 'attack_vector': 'Unauthorized Access',
 'data_breach': {'file_types_exposed': ['Video footage', 'Game map'],
                 'sensitivity_of_data': 'High (unreleased intellectual '
                                        'property)',
                 'type_of_data_compromised': 'Unreleased game footage and map'},
 'date_detected': '2024-08-17',
 'date_publicly_disclosed': '2024-08-20',
 'description': 'Take-Two Interactive issued subpoenas to Microsoft and '
                'Discord to uncover the source of a GTA 6 leak. The leak '
                'involved unreleased footage and a portion of the game’s map '
                'posted by an account named CyberLeek, who framed the act as '
                'an ideological protest. The leaker also promoted a '
                'Solana-based cryptocurrency token, $CYBERLEEK, and warned '
                'game publishers of future leaks. The subpoenas demand user '
                'data from three Discord servers dating back to June 1. '
                'Additionally, fraudsters have exploited the leaks to '
                'distribute malware and phishing scams.',
 'impact': {'brand_reputation_impact': 'High',
            'data_compromised': 'Unreleased GTA 6 footage and game map'},
 'investigation_status': 'Ongoing',
 'motivation': 'Ideological Protest',
 'post_incident_analysis': {'root_causes': 'Unauthorized access to unreleased '
                                           'game assets, potential insider '
                                           'threat or third-party breach'},
 'references': [{'date_accessed': '2024-08-20',
                 'source': 'Cyber Incident Description'}],
 'regulatory_compliance': {'legal_actions': 'Subpoenas issued to Microsoft and '
                                            'Discord'},
 'response': {'containment_measures': 'Legal subpoenas issued to Microsoft and '
                                      'Discord'},
 'threat_actor': 'CyberLeek',
 'title': 'GTA 6 Leak Investigation: Take-Two Targets Discord Servers in Data '
          'Hunt',
 'type': 'Data Leak'}