GTA 6 leak hunt goes deeper as Take-Two targets Microsoft and Discord data

Take-Two has moved past deleting GTA 6 clips and into the far more consequential phase of a leak crackdown: mapping the people, devices, cloud accounts, and communities behind them. Its two DMCA subpoenas seek records from Microsoft and Discord that could turn the CyberLeek alias into a real-world identity — or at least burn down the digital trail around it.

The filings, submitted in the Southern District of New York on August 20, target alleged Grand Theft Auto VI gameplay leaks distributed through Microsoft and Discord services. Microsoft and Discord are due to respond by September 4, 2026. That is a fast turnaround in publisher-legal terms, and it tells everyone reposting, mirroring, or casually hosting unreleased material that Rockstar’s parent company is treating this as an identification operation, not another round of whack-a-mole takedowns.

This is a hunt for metadata, not screenshots

The Microsoft subpoena reaches well beyond a request to remove files. Take-Two seeks internal Microsoft business and investigative records connected to CyberLeek, alongside account IDs, registration emails, registration and last-login IP addresses, phone numbers, linked Google and Xbox connections, device identifiers, Microsoft Account data, and OneDrive material connected to GTA, Rockstar, or CyberLeek.

That combination matters because a disposable username is only as useful as the gaps around it. A throwaway email, VPN, or burner account can obscure one piece of the chain. It does much less when a platform has historical IP logs, a linked Xbox account, a phone number, a Windows device identifier, and cloud-storage activity that can be compared against each other.

One allegation in the subpoena description places the first leaked footage on GitHub, Microsoft’s developer platform, before it spread elsewhere. The OneDrive and device-data requests show Take-Two is trying to establish more than who uploaded a clip. The goal is to connect files, hardware, accounts, and distribution activity into a usable identity trail.

Discord users can get caught in a much wider net

The Discord request is where this gets uncomfortable for people who were never the original poster. Take-Two seeks identifying information for accounts associated with named servers and users, including accounts that belonged to or communicated in those communities. The package names accounts including CYBERLEEK, CINEMATICROCKSTAR, and Surfer24k, along with servers that include !Odyssey and a community server affiliated with Matthew “Matt” Judge, known online as DarkViperAU.

Being named in a subpoena does not establish that someone leaked anything. That distinction is not lawyerly nitpicking; it is the central risk of casting a net across chat servers. Judge has denied involvement, and a community affiliation is not proof that its owner, moderators, or ordinary members created, possessed, or distributed the alleged material.

Still, Discord can provide the sort of connective tissue that makes aliases less anonymous: emails, IP addresses, phone numbers, linked accounts, participation records, device data, telemetry, and content tied to the alleged leak chain where those records exist. Discord has said it reviews and complies with valid DMCA subpoenas as a standard part of operating a platform of its size.

Take-Two is targeting the distribution network, not only CyberLeek

For players, this changes the practical lifespan of a leak. A standard DMCA notice can remove one upload while copies sprint across Discord, X, cloud drives, and archive accounts. Identity-focused subpoenas pressure the infrastructure around that upload: storage hosts, chat communities, reuploaders, and anyone whose account data helps join the dots.

That approach is particularly pointed because the CyberLeek ecosystem was not behaving like a quiet anonymous dump. The initial videos included a pitch for a Solana memecoin, while a site update offered paid in-video ads and custom-made gameplay footage. It also sought more than $164,000 in cryptocurrency to negotiate a deal. Whether those monetization claims lead anywhere is unresolved, but they give Take-Two every incentive to treat the operation as a potentially commercial exploitation of GTA 6 rather than fandom’s usual leak-tourism.

The DMCA process is narrower and faster than a full lawsuit over damages. It is designed to identify alleged infringers. It also has limits: Microsoft and Discord can only produce records they retained, and they can challenge or seek to narrow demands. The subpoenas do not mean Take-Two has already unmasked CyberLeek, nor do they authenticate the alleged GTA 6 footage or establish who created it.

September 4 is the first date that matters

Watch the platforms’ response deadline on September 4. Compliance would give Take-Two its first serious chance to correlate Microsoft storage and device records with Discord’s account and community data. An objection or narrowed response would slow the process and reveal where the company’s broadest requests run into legal resistance.

The next meaningful development is not another blurry GTA 6 clip. It is whether the subpoena returns lead to a named defendant, a broader civil action, or a criminal referral. Until then, CyberLeek remains an alias under investigation, and GTA 6 remains a game Rockstar and Take-Two have not publicly authenticated in connection with this latest material.