Take-Two Strikes Back — Subpoenas to Microsoft and Discord Take the GTA6 Leaker Hunt to Court
Since August 18, footage said to be unreleased GTA6 gameplay has been leaking onto the internet in bursts. "Cyberleek," the party claiming the leaks, raised the banner of "gamer rights," pressed demands on the games industry over digital pre-orders and physical discs, and has kept publishing new footage since. Some of that footage has even raised the suspicion that whoever is behind it does not merely possess pre-recorded video, but has access to some playable build of GTA6.
Rockstar Games has issued no major public statement about the affair. Behind the scenes, though, parent company Take-Two Interactive had already begun to move.
On August 20, Take-Two was reported to have applied to the US District Court for the Southern District of New York for DMCA subpoenas to obtain records relating to the GTA6 leak from Microsoft and Discord. What is sought is not a simple takedown but account details, email addresses, IP addresses, phone numbers, linked services, device information — and, in some cases, GTA-, Rockstar- and Cyberleek-related data stored in OneDrive.
In other words, Take-Two has moved past the stage of deleting the leaked videos and on to the stage of identifying the person who put them out.
Every image in this article is an AI-generated illustration made to help convey the story. None of them are real court filings, leaked material, or internal corporate documents.
Why Take-Two Went to Court
What Take-Two wants are the user records held by Microsoft and Discord. The mechanism reported to have been used is the one under Section 512(h) of the US Digital Millennium Copyright Act — the DMCA — which a copyright holder uses to ask an online service provider to disclose information identifying an alleged infringer.
The important point here is that Take-Two has not filed a damages claim against Cyberleek. This is the stage that comes before that: identification. Take-Two is gathering information to work out who was involved in the leak and to protect the GTA6-related copyrighted works it owns.
Those works are reported to include not only gameplay footage and images but artwork, dialogue, and other creative elements contained in GTA6. Until a few days ago, what Take-Two was doing was issuing takedowns against footage circulating online. Now it is trying to trace the person behind it.
Why Microsoft Became a Target
Discord is the easier of the two to explain. If Cyberleek and the communities around the leak were active on Discord, then account registration details and login history are a strong lead toward identification.
Microsoft, the other target, is not on the list for the simple reason that it runs Xbox. According to outlets that have reviewed the filings, Take-Two is seeking Microsoft's internal records associated with the name Cyberleek, along with registered email addresses, IP addresses, phone numbers, linked accounts and device information.
OneDrive has drawn particular attention. On the assumption that GTA-, Rockstar- and Cyberleek-related content connected to the leak may have been stored in Microsoft's cloud storage, records for the associated accounts are reported to fall within the scope of disclosure as well.
GitHub and other Microsoft-owned services that may have been used to store the leaked material or share links to it have also been raised as points of contact for the investigation. Microsoft, then, is a target not as a games platform company but as the owner of several online services Cyberleek may have used.
Discord Asked to Disclose Multiple Accounts
The demands made of Discord are quite specific. According to reporting, the subpoena names several handles — including "CYBERLEEK," "CINEMATICROCKSTAR" and "Surfer24k" — and Take-Two is seeking identifying information for those accounts.
For certain Discord servers, the scope is reported to extend to records of accounts that joined or communicated there on or after June 1, 2026. The information sought includes account IDs, registered email addresses, IP addresses at registration and last login, phone numbers, linked services and device information.
Judged by that scope, Take-Two is not chasing a single anonymous account called "Cyberleek." It is trying to trace, across services, every route that person may have used. Even if the anonymous account itself is a pseudonym, tying together IP addresses, registration details and linked accounts used across multiple services could bring it closer to whoever is behind them.
The GTA Community Falls Within the Scope Too
The subpoena is reported to name a Discord server said to be associated with the community of DarkViperAU, known for videos on the GTA series — a detail that became a talking point among GTA fans.
This point needs to be handled carefully, though. A server name appearing in a subpoena does not mean the server's operators, DarkViperAU personally, or the users in it were involved in the leak. What Take-Two wants to know is whether Cyberleek or the leaked material passed through there, or whether anyone connected to it left traces there.
It is hardly unusual for a large Discord community to have thousands or tens of thousands of users passing through. A community's name appearing in a legal document and that community bearing responsibility are two things that must be kept clearly separate.
What is notable about this investigation is that the GTA6 leak has stopped being an internal matter for Rockstar and Take-Two, and has begun to widen into the ordinary online communities around GTA.
Microsoft Signals Its Cooperation With Rockstar
Microsoft, for its part, has signaled that it is cooperating with Take-Two and Rockstar Games on the matter. Xbox CTO Scott Van Vliet is reported to have said, in substance, that Microsoft is working closely with both companies and supporting efforts to protect creative work and intellectual property.
Exactly what information Microsoft has provided to Take-Two is not known at this point. Nor is it certain that every demand in the subpoena will be granted as written and every record handed over.
Even so, it is clear that this leak investigation is no longer something that ends inside Rockstar. It has grown into a matter involving several organizations at once: Take-Two, Rockstar, Microsoft, Discord and a US federal court.
A handful of gameplay videos that began circulating on social media on August 18 turned, in a matter of days, into a case pulling in corporate legal departments and the courts.
September 4 as a Turning Point
One date stands out in these proceedings: September 4. According to reporting, it is the deadline set for producing the records demanded from Microsoft and Discord.
That does not mean Cyberleek's real name will be published on September 4, of course. There is no guarantee the data provided will be made public, and Take-Two will need to analyze what it receives and cross-reference records across several services.
Still, if email addresses, IP addresses, phone numbers, device information and linked accounts line up across multiple services, that becomes a lead toward identifying the person behind the anonymous account. Using the name "Cyberleek" online is one thing; maintaining perfect anonymity across every service that person uses is another.
In that sense, September 4 could well be a turning point in this affair.
A Subpoena Is Not an Arrest Warrant for Cyberleek
In the wake of this reporting, social media has produced some strong phrasings: "Take-Two has subpoenaed Cyberleek," "the leaker is going to be arrested." What is actually happening is something different.
The principal targets of these subpoenas are not Cyberleek but Microsoft and Discord, the parties holding the information. By obtaining user records from those two companies, Take-Two is trying to identify the party said to have infringed its copyright.
This subpoena is therefore neither an arrest warrant nor a judgment establishing criminal or civil liability for Cyberleek. Where things stand is this: a leak happened, takedowns followed, and now evidence and records are being gathered to establish identity.
Even if a person is identified, what legal steps Take-Two takes afterward remains unknown. It could proceed to a civil suit; it could also spend considerably longer simply establishing the facts.
An Unease the 2022 Leak Did Not Have
This is not the first time GTA6 information has escaped Rockstar. In 2022, around 90 in-development videos leaked onto the internet, exposing GTA6 — then still unannounced — on a massive scale.
Measured purely by volume, the Cyberleek affair does not currently match 2022. In another sense, though, this one puts Rockstar in a more awkward position.
In some of the leaked footage, Jason is reported to shoot a wall so that the bullet holes spell out "LEEK." If that footage is genuine, it raises the possibility that Cyberleek did not merely obtain saved video, but has access in some form to an environment where the game can be played.
Image: an AI-generated illustration made to convey the reported "LEEK spelled in bullet holes" scene. It is not the leaked footage itself.
Whether Cyberleek personally holds a game build, whether someone else is playing and merely supplying footage, or whether it came by some other route, none of this has been confirmed. What matters to Take-Two, though, is probably not the number of videos already published but how much unreleased data the person behind them can still reach.
Is this a problem that ends once the handful of videos now online are deleted, or will more material keep appearing unless the route itself is closed? That difference is a large one.
Will "An Extended Look" Go Ahead on August 27?
This affair has also landed at an extremely awkward moment for Rockstar. GTA6's "An Extended Look" is scheduled for August 27 — a milestone at which the marketing run-up to launch was supposed to shift into a higher gear.
Image: an AI-generated illustration evoking the atmosphere of GTA6's setting, Leonida. It is not an actual game screenshot or leaked material.
Instead, right before it, Cyberleek appeared. Footage said to be gameplay leaked, an image said to be a full map of Leonida spread, and new videos kept coming. Suspicion of access to a playable build followed, and Take-Two has now entered the stage of seeking user information from Microsoft and Discord through a federal court.
Rockstar, at least outwardly, has not significantly changed its plans. It has issued no detailed statement about the leak and is continuing the marketing push toward the official August 27 reveal. Behind that, Take-Two's legal team is working to identify the source.
Out front, preparations to show GTA6 on schedule. Behind, a hunt for whoever showed GTA6 without permission. Rockstar and Take-Two are currently running both at once.
Cyberleek's Wanted Level Has Certainly Gone Up
In the GTA series, the more crimes you commit, the higher your wanted level climbs and the larger the police response becomes. The situation cannot be equated with the game itself, but there is something ironic in how the affair has escalated.
At first it was just a few videos leaking onto social media. Then more gameplay was posted, and copyright takedowns did not stop Cyberleek from continuing. Now Take-Two is seeking, through the courts, the user records held by Microsoft and Discord.
What Take-Two is pursuing, in other words, is no longer just GTA6 videos sitting on the internet. It is following email addresses, IP addresses, cloud storage, Discord accounts and linked services toward the person on the other side of the screen.
To put it in GTA terms, Cyberleek's wanted level has gone up. From here, though, this is not a chase that ends by losing the police cars. It is a real-world pursuit against the records left on online services, corporate legal departments, and a court.
What will Microsoft and Discord hand over by September 4? Before that, on August 27, will Rockstar publish "An Extended Look" as planned? And will Cyberleek put out more material in the meantime?
Roughly three months to launch. Somewhere apart from GTA6's own marketing, a second chase is under way.
Note: This article is based on public information as of August 22, 2026. What Take-Two is reported to have done is initiate DMCA subpoena proceedings to obtain information from Microsoft and Discord; it is not an arrest warrant or a guilty verdict against Cyberleek. The appearance of an account, Discord server or community in a subpoena does not mean its operators or members were involved in the GTA6 leak. The identity of the person or group said to be Cyberleek, and the specific route the material took, have not been officially established at this point. Every image in this article is an AI-generated illustration and is not a real court filing or leaked material.