Take-Two Subpoenas Microsoft and Discord in GTA 6 Leak Investigation
Take-Two Interactive is seeking user data from Microsoft and Discord to identify the perpetrator behind the Grand Theft Auto 6 leak, potentially exposing thousands of users.
Take-Two Interactive, the publisher of the highly anticipated Grand Theft Auto series, has initiated legal action to uncover the identity of the individual responsible for leaking footage of Grand Theft Auto 6. The company filed a subpoena on August 20th, targeting Microsoft and Discord, demanding a wide range of user data. This data includes IP addresses, phone numbers, linked Google and Xbox accounts, OneDrive contents, MachineGuid values, and Microsoft account device IDs for members of three specific Discord servers.
The leak, which began on August 17th, was initiated by an account named CyberLeek, who also published a manifesto outlining ideological motives for the act. These motives included demands for publishers to cease digital-only game releases, stop charging extra for unlocked single-player content, and guarantee the permanent preservation of single-player modes. CyberLeek also launched a cryptocurrency token, $CYBERLEEK, on the Solana network, which some observers believe was an attempt to inflate its value through the publicity of the leaks.
While CyberLeek claimed ideological reasons, the timing of the leaks and the cryptocurrency launch led to accusations of market manipulation. However, the individual or group behind CyberLeek later 'burned' their substantial holding of the token, a move that effectively removes it from circulation but still allows them to collect trading fees. The token reportedly generated up to $60,000 in trading fees in the week prior to this action.
The subpoena specifically names Discord servers, including one belonging to Australian GTA 5 streamer Matthew Judge, known online as DarkViperAU. Judge has publicly stated his lack of involvement and knowledge regarding the leak. Microsoft and Discord have until September 4th to comply with the subpoena. If they do, potentially thousands of users who have no direct connection to the leak could have their identifying information handed over to Take-Two as part of its investigation.
This incident is not the first security challenge faced by Take-Two and its subsidiary Rockstar Games. In April, the ShinyHunters cybercrime group obtained 78.6 million Rockstar records by compromising Anodot, a cloud analytics vendor, rather than directly breaching Rockstar's internal systems. This method of targeting third-party service providers that hold customer data has become a modus operandi for ShinyHunters.
Furthermore, GTA-related leaks are not unprecedented. In September 2022, a hacker also posted video footage of GTA 6 online. The ongoing popularity of the GTA franchise continues to attract malicious actors, leading to various scams targeting gamers. These scams often involve fraudulent offers of in-game currency, malware-laden mods, and fake early access opportunities designed to steal cryptocurrency.
Gamers are advised to exercise extreme caution regarding any unofficial offers related to GTA 6. Malwarebytes researchers have recently identified fake websites promoting "GTA 6 Extended Look" and demo versions that lead to password-stealing malware. Players are urged to avoid believing offers of early access or downloadable demos and to secure their accounts by pre-ordering directly from Rockstar Games. The official release for consoles is scheduled for November, with a PC release to follow later.