The threat actor known as CyberLeek leaked unreleased Grand Theft Auto VI footage and map material starting in August 2026. The actor now says it will release a full playable build of the game if its cryptocurrency token reaches a $30 million market capitalisation, according to Firewall Scoop. Take-Two Interactive has not made a detailed public statement. Its own federal court filings call the material "leaked content" and "the stolen content from our copyright," which in effect confirms that the leaked material is real. In August, Take-Two filed four DMCA subpoena applications in the Southern District of New York to identify the leaker, and two were granted (Digital Citizen). Eurogamer reviewed roughly 25 minutes of newer footage carrying CyberLeek's emblem and said it appears legitimate (via Firewall Scoop). GTA VI is scheduled for release on November 19, 2026, which gives the threat a fixed deadline. A note on sourcing: every source for this brief is secondary reporting or third-party analysis. No victim statement, regulator filing or vendor advisory was available. Court records are cited as Digital Citizen reported them.
What Happened
The leaks. GIGAZINE reports that around August 18, 2026, a leaker calling themselves "CYBERLEEK" began posting GTA VI gameplay footage and several map images. Users who reshared the material on X received DMCA takedown requests. A YouTube reply to a complaint sent from a rockstargames.com address on August 21, filed as a court exhibit, confirms that content was removed (Digital Citizen).
The crypto scheme. GIGAZINE, citing CoinDesk, reports that the leaker watermarked the footage with their own memecoin, $CYBERLEEK, and the text "The higher the market capitalization, the more leaks there will be." The coin reportedly peaked at about $25 million in market cap. The leaker is believed to have sold their holdings a few hours before Rockstar's official gameplay reveal. Reported profits differ: CoinDesk, via GIGAZINE, puts them at about $125,000, while a Tom's Hardware headline cited in the same article puts them at roughly $250,000. Neither figure is confirmed.
The new threat. Firewall Scoop reports that CyberLeek released new footage and then set a $30 million market cap target for its token as the trigger for publishing a complete, playable build. Graham Cluley, cited by Firewall Scoop, describes this as an unusual ransom variant: instead of asking the victim to pay, it relies on fan hype to inflate the token. CyberLeek also says it will stand down if Rockstar releases GTA VI on physical disc and issues a public apology.
The legal response. Accounts differ in the details:
- Digital Citizen (from the court docket): Take-Two filed four DMCA subpoena applications on August 20 and 21, 2026, naming Microsoft, Discord, Google and X Corp. Judge Analisa Torres granted the X Corp subpoena on August 24. Judge Andrew L. Carter, Jr. granted the Discord subpoena on August 31. As of October 9, the docket shows no new filings since August.
- GIGAZINE (citing TorrentFreak, September 1): the targets were Discord, Microsoft, X and YouTube. Take-Two withdrew the YouTube subpoena, said the investigation is "progressing rapidly," and asked for new Discord demands under seal.
- Firewall Scoop names only Microsoft and Discord.
YouTube is a Google property, so the "Google" and "YouTube" references probably describe the same request. Sealed filings could also explain why the public docket looks quiet. Either way, the public record shows the subpoena effort began in August, before the $30M threat. It was not a response to it.
What Was Taken
Three things are confirmed or strongly corroborated: gameplay footage (including the roughly 25 minutes Eurogamer judged legitimate) and map images (GIGAZINE). Take-Two's court filings treat this material as stolen copyrighted content.
Whether a playable build was taken is disputed.
- Security consultancy Lares, as relayed by Threat Radar and Unixgaming, says the August 2026 incident involved exfiltration of a playable GTA VI development build, 13 or more gameplay videos and full map data.
- CyberLeek's own threat implies it holds a full build but has not released it.
- Threadlinqs reports that criminals used the CyberLeek leak as cover to spread a fake 113GB "GTA VI build" containing a malicious payload of about 50KB.
- Take-Two has not publicly confirmed that a playable build was stolen. Unixgaming notes the company has not confirmed the technical details in the Lares report.
Treat any build claim as unverified until the company or a credible independent analysis confirms it.
Material that is not part of this incident:
- The 192GB dump (September 17 and 18). Insider Gaming and Kotaku, via SixShore, identify this as leftover material from the September 2022 Lapsus$-era breach: cut GTA V DLC and early low-quality GTA VI map renders. It is not a 2026 build and not from CyberLeek.
- ShinyHunters incidents. Threadlinqs and Unixgaming report an April 2026 theft of about 78.6 million analytics records from Rockstar's Snowflake environment. Tech-Insider, citing Security Affairs, reports a separate September 21 ShinyHunters leak-site claim of about 8.1GB including anti-cheat code. That second claim has not been independently verified, and Rockstar has not confirmed it. Threadlinqs groups ShinyHunters, Lapsus$ and CyberLeek in one record with "medium" attribution confidence, but it describes the incidents as separate in mechanism. Nothing in the sources links CyberLeek to ShinyHunters.
Why It Matters
- A new extortion model. Pump-and-dump extortion turns the victim's audience into the source of payment. The victim cannot pay to stop it, and the attacker can profit whether or not the threat is ever carried out. The reported rug pull before the official reveal suggests the token, not the leak, is the main revenue source.
- The leak's fame becomes a malware lure. The fake 113GB build reported by Threadlinqs shows how quickly a well-known leak gets turned into a malware delivery campaign aimed at fans, and potentially at employees and contractors.
- Repeated compromise. By the sources' count, Rockstar has been compromised at least three or four separate times since 2022. Lares notes that none of them reportedly required a zero-day (Threat Radar, Unixgaming). The common weaknesses are identity, tokens and internal controls, not unpatched software.
- Legal identification is slow. DMCA subpoenas to platforms take weeks, and in this case the leaker's pre-release window closes on November 19.
The Attack Technique
Take-Two has not disclosed how CyberLeek got access to the material. The only technical assessment in the sources is Lares's analysis (via Threat Radar). It describes the August 2026 incident as a failure of data loss prevention (DLP) and network segmentation, because that volume of data apparently left a development subnet without triggering alerts. This is a third-party reconstruction, not a confirmed root cause. The other Rockstar incidents in the sources used different entry points:
- 2022, Lapsus$: MFA fatigue against an employee, followed by harvesting plaintext credentials and API keys from Slack and Confluence.
- Early 2023, GTA Online: PC peer-to-peer netcode reverse-engineered into remote code execution.
- April 2026, ShinyHunters: long-lived OAuth tokens stolen from SaaS analytics vendor Anodot and replayed against Rockstar's Snowflake instance (Threadlinqs, Threat Radar).
On the distribution side, the token-pump mechanism (watermarking leaks with a ticker and tying further leaks to market cap) is how the attacker makes money, with no ransom negotiation involved.
What Organizations Should Do
- Set egress baselines for development and build networks. Alert on large or unusual outbound transfers from subnets holding source code, builds or pre-release media, and block bulk transfers to personal cloud storage or messaging platforms.
- Watermark sensitive pre-release assets per recipient. Invisible forensic watermarks on builds and footage cut the time needed to attribute a leak far below what court subpoenas take.
- Manage non-human identities. Inventory third-party OAuth and SaaS tokens, enforce short lifetimes and IP or workload binding, and monitor warehouse access (Snowflake and similar) for token replay.
- Use phishing-resistant MFA and clean up collaboration tools. Replace push-approval MFA with FIDO2, and regularly scan Slack, Confluence and wikis for plaintext credentials.
- Prepare for leak-themed malware. Warn staff and the community about fake builds, block known leak-lure file hashes, and treat "leaked build" downloads as a likely infection route.
- Set up legal and platform response in advance. Line up DMCA and trusted-flagger channels with major platforms (X, Discord, YouTube, Microsoft) before a high-profile launch, so takedowns and identification requests move in days rather than weeks.
Sources: $30M Crypto Target: GTA 6 Leaker Threatens Full Build, Take-Two | Take-Two Won Two Court Orders Over GTA 6 Leaks, and the Docket Has... | Rockstar Games Breaches — Threat Intelligence Threadlinqs | Rockstar Games has now been compromised several different… Threat... | Rockstar Breach: MFA Fatigue Hit 78.6M Records 2026 | ShinyHunters Breach Rockstar Again, Leak 8.1GB 2026 | The investigation into the 'GTA 6' leak incident is progressing, wi... | The 192GB dump circulating today is leftover 2022 leak material, no...