The GTA 6 Leak Subpoena, Explained

In the run-up to the Extended Look, a hacker operating as "CyberLeek" began posting gameplay footage claimed to be pulled from a playable GTA 6 build, scattering it across file hosts and forums faster than it could be taken down. Take-Two's response wasn't just a takedown campaign — it went to federal court for subpoenas against Microsoft and Discord, and the paper trail it's asking for reaches a lot further than just one leaker's identity.

What actually leaked

CyberLeek's videos were presented as direct capture from a working build of the game rather than concept material or a mockup, and they spread through the usual channel-hop pattern leaked footage always follows now: posted, pulled down under copyright claims, re-uploaded somewhere else within hours, repeated. Rockstar didn't attempt to slow the Extended Look or the November 19 release date over it — whatever damage the leak did to the surprise, it clearly wasn't judged severe enough to touch the marketing calendar.

The subpoenas: what Take-Two is actually asking for

Take-Two filed for subpoenas compelling Microsoft and Discord to hand over identifying records tied to the CyberLeek account, using the DMCA's subpoena provisions as the legal vehicle. The requested information isn't limited to a name and email — it reaches into device-level identifiers, sign-in IP history going back months, phone numbers on file, linked platform accounts, and even the contents of associated cloud storage. This is a dragnet built to identify one person by cross-referencing everything those platforms know about the accounts involved, not a narrow request for a single username's registration email.

Critically, the subpoenas don't target CyberLeek alone. They name three specific Discord servers and request records for every account that posted in them going back to June 1 — meaning anyone who so much as sent a message in the wrong server during that window is now part of the data Microsoft and Discord have been asked to hand over, regardless of whether they had anything to do with the leak.

The collateral damage: DarkViperAU

That server-wide scope produced an outcome nobody engineered on purpose but that was always the predictable cost of casting the net that wide: one of the three named servers belongs to DarkViperAU (Matthew Judge), a well-known Australian GTA streamer and YouTuber with no evident connection to the leak. Because his community happened to be one of the servers under scrutiny, his server's membership — and by extension a slice of his audience's private account data — is now swept into a subpoena aimed at catching one anonymous leaker.

A subpoena built to unmask one person ended up putting the private account data of an entire fan community on the table, including people who never leaked anything and never will.

This is the part of the story that outlasts the leak itself. Individual leakers come and go — GTA 6 has already weathered a much larger 2022 leak and survived it commercially and creatively. Dragnet subpoenas that treat "everyone who posted in this server" as a legitimate proxy for "people who might be the leaker" are a durable precedent, and one that has nothing to do with whether this particular leak mattered.

Why Take-Two is pushing this hard

From Take-Two's side, the incentive is straightforward: this is the most valuable unreleased game in the industry's history, weeks away from a launch built on tightly managed reveals, and an uncontrolled leak channel undermines that control regardless of the leak's actual quality or completeness. Pursuing the leaker aggressively also sends a deterrent signal to anyone else sitting on unreleased material ahead of November 19. The legal aggression is rational from a pure IP-protection standpoint — the question worth asking is whether the scope of who else gets pulled in is a proportionate cost of that deterrence.

What happens next

Microsoft and Discord were compelled to respond by early September; neither company is the target of the subpoenas and both have processes for user notification and, in some cases, narrowing overly broad requests before complying. Whether CyberLeek's identity actually gets unmasked through this process, and whether affected Discord members outside the leak itself have any recourse over having their data pulled into it, are both still open. We'll update this piece if either resolves publicly.