Take-Two Interactive appears to be getting closer to the people potentially connected to the massive Grand Theft Auto VI leaks, with new court filings revealing that the publisher has identified an additional Discord user and obtained more identifying information about another person already under investigation.
The legal hunt for the individual or group operating under the Cyberleek name has entered a new phase.
After initially seeking extensive user information from Discord and Microsoft, Take-Two has returned to federal court with a significantly more targeted request connected to its investigation into the unauthorized distribution of GTA 6 development footage.
And unlike the company’s earlier public filings, Take-Two wants the details of its latest request kept secret.
The reason is straightforward: it doesn’t want the people being investigated to know what Take-Two has discovered about them.
Take-Two Says Its Cyberleek Investigation Is “Rapidly Evolving”
According to a new filing made on August 28, Take-Two says its investigation into the GTA 6 leaks is “rapidly evolving and ongoing.”
That’s particularly significant because the company’s latest request is considerably more focused than the initial subpoenas.
Take-Two says it has now:
- Identified one additional Discord user
- Obtained additional identifying information about a previously identified Discord user
- Gathered further information concerning Discord community servers previously included in its investigation
- Requested more targeted information relating to those accounts and servers.
According to the filing, the additional accounts and server are believed by Take-Two to be involved in the same alleged infringing activity described in its original request.
That doesn’t establish that any of these users are Cyberleek or that they committed wrongdoing.
But it does indicate that Take-Two’s investigation has progressed beyond the broad information-gathering phase that began shortly after the leaks appeared.
Take-Two Doesn’t Want the Suspects to Know What It Knows
Perhaps the most interesting part of the new development is Take-Two’s attempt to keep the details confidential.
Previous subpoena filings exposed considerable information about what the publisher was looking for.
This time, Take-Two argued that public disclosure could compromise the investigation.
The company specifically warned that revealing what it has learned could tip off the alleged infringers, potentially allowing them to delete, destroy or conceal evidence or take additional measures to avoid being identified.
In other words, Take-Two doesn’t want the investigation itself providing a roadmap to whoever it’s trying to find.
That explains why the identities involved in the latest request haven’t been publicly revealed.
The Court Has Now Granted Take-Two’s Latest Request
There’s already been an important development since the new filing first became public.
On September 1, Judge Andrew L. Carter granted Take-Two’s request for a new subpoena seeking additional information from Discord.
According to the ruling, the court found sufficient reason to direct the clerk to issue the subpoena.
It also appears Take-Two succeeded in its effort to keep the sensitive details under wraps.
The judge acknowledged the separate request to seal the supporting documents and stated that the subpoena would be issued as sought by Take-Two.
That means the situation has already progressed beyond what was shown in some of the reports circulating yesterday.
Take-Two isn’t merely asking permission anymore.
The latest request has been granted.
The First Investigation Cast an Extremely Wide Net
Take-Two’s initial response to the leaks was much broader.
After GTA 6 development footage began circulating online in August, the publisher filed DMCA subpoena requests involving both Microsoft and Discord.
The Microsoft request sought internal business and investigative records connected with the Cyberleek persona.
It also requested identifying information potentially including account IDs, registration emails, IP addresses, phone numbers, linked accounts, device identifiers and relevant OneDrive content.
The Discord side was even more controversial.
Take-Two sought identifying information associated with accounts communicating within several Discord servers connected in some way to the investigation.
PC Gamer noted that the scope could potentially involve information relating to thousands of users, creating privacy concerns among people who may simply have been present in those communities.
The latest subpoena appears significantly narrower.
That could suggest information gathered during the investigation has allowed Take-Two to focus on particular accounts.
Microsoft Could Be Particularly Important to the Investigation
Microsoft has potentially become one of the most important pieces of the investigation.
Take-Two’s earlier request specifically sought records associated with what it described as Microsoft’s internal investigation into the Cyberleek persona.
The company requested information capable of identifying users, people or entities associated with Cyberleek.
The requested information went considerably beyond an email address.
It included registration and login IP addresses, phone numbers, connected accounts and device identifiers.
Those device identifiers are particularly interesting because they could potentially help investigators connect activity across multiple accounts or services.
However, a request for information should not automatically be interpreted as proof that Microsoft possesses evidence identifying Cyberleek.
Take-Two Also Went After X and YouTube
The investigation didn’t stop with Microsoft and Discord.
Take-Two subsequently expanded its efforts to platforms including X and YouTube, seeking records connected with accounts believed to have distributed GTA 6 material.
The X request targeted several usernames, while the Google/YouTube request focused on a specific video and multiple channels.
There was an interesting complication.
Members of the GTA community had already flagged some of the X accounts targeted in Take-Two’s filing as possible Cyberleek impersonators, rather than the actual source of the leaks.
Cyberleek itself later reportedly added messages to leaked footage claiming it did not operate an X account.
That illustrates one of Take-Two’s biggest problems.
Once leaked material spread across the internet, hundreds or thousands of accounts could repost it.
Identifying who uploaded a video isn’t necessarily the same thing as identifying who originally obtained the GTA 6 material.
Take-Two Has Now Changed Course on Google
Another interesting development happened on August 28.
Take-Two withdrew its DMCA subpoena request involving Google, saying the investigation was changing rapidly as new information became available.
That doesn’t necessarily mean Google or YouTube became irrelevant.
Instead, the timing is notable.
On the same day that Take-Two withdrew that request, it filed its new, more targeted request involving Discord.
That could indicate the company decided another investigative route had become more promising.
However, because the newest information is being kept confidential, we don’t know exactly what Take-Two discovered or why its priorities changed.
Cyberleek’s GTA 6 Leaks Became a Major Problem for Rockstar
The investigation follows one of the biggest GTA 6 leaks since the enormous 2022 breach.
Beginning in August, someone using the Cyberleek identity began distributing development footage apparently showing multiple gameplay systems from GTA 6.
The clips spread rapidly across Discord, social media and other platforms despite Take-Two issuing takedown notices.
Rockstar eventually publicly addressed the situation.
The studio described seeing unfinished GTA 6 material distributed without authorization as “heartbreaking” for the development team, while assuring players that the game was nearly there.
The leaks became particularly sensitive because they emerged immediately before Rockstar’s planned Grand Theft Auto VI: An Extended Look presentation.
Cyberleek Also Made Money From a Cryptocurrency
The situation became even stranger because Cyberleek wasn’t simply releasing GTA 6 footage.
The identity was also connected with a cryptocurrency called $CYBERLEEK.
According to Tom’s Hardware, Cyberleek used attention surrounding the GTA 6 leaks to promote the token before ultimately cashing out approximately $250,000.
The token subsequently collapsed in value.
This added another dimension to an already complicated situation involving copyright infringement, confidential development material, anonymous online identities and multiple technology platforms.
Is Take-Two Close to Identifying Cyberleek?
Possibly — but there’s currently not enough evidence to say that.
The new filing clearly shows progress.
Take-Two has identified another Discord user.
It has obtained additional identifying information regarding someone it was already examining.
It has narrowed its information requests.
And it convinced a federal court to authorize another subpoena while apparently keeping sensitive details sealed.
Those are meaningful developments.
But none of them publicly establishes that Take-Two has identified the person operating Cyberleek.
It’s also possible that multiple people were involved in obtaining, distributing or reposting the material.
The sealed nature of the latest filing makes it impossible for the public to know exactly how close investigators are.
Being Investigated Does Not Mean Someone Is Guilty
There’s another important distinction.
The newly identified Discord users should not automatically be described as GTA 6 leakers.
Take-Two believes the accounts are connected to the same alleged infringing activity, but that is the company’s position during an ongoing investigation.
There has been no publicly disclosed judicial finding establishing that these individuals stole GTA 6 material or operated Cyberleek.
And because the latest filing is sealed, their identities aren’t currently public.
That’s particularly important given the enormous amount of attention surrounding GTA 6.
Incorrectly identifying someone as Cyberleek could have serious consequences.
The Hunt for Cyberleek Has Entered a Much More Secretive Phase
Take-Two’s strategy appears to have changed substantially in less than two weeks.
Initially, the company cast a wide net.
Microsoft.
Discord.
X.
YouTube.
Thousands of potential accounts and large quantities of identifying information.
Now, the investigation appears more focused.
Take-Two says it has discovered additional users and identifying information, abandoned at least one previous request and returned to Discord with a narrower subpoena.
Most importantly, it no longer wants the public to see exactly what it’s looking for.
That may be the strongest indication yet that the Cyberleek investigation has moved into a more serious phase.
Whether Take-Two ultimately identifies the person—or people—responsible remains unknown.
But after weeks of Cyberleek publicly challenging one of the largest publishers in the gaming industry, Take-Two’s legal hunt appears far from over.
Frequently Asked Questions
Has Take-Two identified Cyberleek?
Not publicly. Take-Two says it has identified an additional Discord user and obtained more identifying information concerning another previously identified user, but it has not publicly confirmed that either person is Cyberleek.
Did Take-Two obtain another subpoena against Discord?
Yes. As of September 1, Judge Andrew L. Carter granted Take-Two’s latest request for a subpoena seeking more detailed information from Discord.
Why is the new subpoena being kept secret?
Take-Two argued that revealing the information could alert the people being investigated, potentially leading them to destroy or conceal evidence or take further steps to avoid identification. The court appears to have accepted Take-Two’s request to keep the relevant details sealed.
Is Microsoft involved in the Cyberleek investigation?
Take-Two previously sought information from Microsoft, including records related to Microsoft’s internal investigation of the Cyberleek persona and identifying information connected to relevant accounts.
Did Take-Two subpoena YouTube and X?
Take-Two expanded its investigation with requests involving X and Google/YouTube, although the Google request was subsequently withdrawn as the investigation evolved.
Has Cyberleek been arrested?
There is currently no reliable public evidence that Cyberleek has been arrested.
Is every Discord user named by Take-Two suspected of being Cyberleek?
No. Appearing in a subpoena or being part of a server involved in an investigation does not establish that a person leaked GTA 6 or committed any wrongdoing.
