Take-Two Subpoenas Microsoft and Discord in Hunt for GTA 6 Leaker

Take-Two Interactive has filed legal subpoena requests against both Microsoft and Discord as it works to unmask the person or group operating under the alias "Cyberleek," who has been leaking Grand Theft Auto VI gameplay clips since August 18. Court filings obtained by Kotaku show that Take-Two has given both companies a September 4 deadline to hand over relevant records — a timeline that underscores how urgently the publisher is treating the investigation with its November 19 launch just twelve weeks away.

The subpoena targeting Microsoft is sweeping in scope. Take-Two is seeking all internal business and investigative records related to the Cyberleek persona, identifying information for any accounts associated with specific Discord servers active from June 1, 2026 onward, and the contents of any OneDrive files linked to those accounts that reference Grand Theft Auto, Rockstar, or Cyberleek. The requested data includes account registration emails, IP addresses, phone numbers, linked Google and Xbox connections, and device identifiers. The Discord subpoena follows a similar pattern, targeting identifying records for users in servers associated with aliases including CYBERLEEK, CINEMATICROCKSTAR, Surfer24k, and Ødyssey.gg.

The legal action has already caught at least one prominent community figure in its crosshairs. Popular GTA streamer Matthew "DarkViperAU" Judge confirmed publicly that his editors' Discord server was referenced in the filings and that he had been named, adding: "They're asking for my discord info, I'm mentioned by name. I don't know anything." His statement illustrates how broadly Take-Two is casting the net — the subpoenas appear designed to map the social graph around Cyberleek rather than to target named suspects directly. Separately, reporting from Bloomberg indicates that as of the filing date Rockstar still had not identified who was behind the breach, describing the studio as operating in "all hands on deck" mode to determine how the leak occurred despite the stricter security protocols implemented after the 2022 Lapsus$ hack.

The subpoenas also revealed a detail that adds an unsavoury dimension to the leak story: Cyberleek has simultaneously been promoting a cryptocurrency scheme alongside the stolen footage. Take-Two has not commented publicly on that aspect, and neither the subpoenas nor any associated filings constitute evidence of criminal conduct on the leaker's part at this stage. For now, the legal machinery is focused on identification rather than prosecution. With the Netflix extended look premiere five days away on August 27, Take-Two is clearly moving on two tracks at once — trying to contain the leak's spread through legal channels while pressing ahead with a marketing campaign it has spent months building.