The hunt for the GTA 6 leaker: what Take-Two has actually asked the courts for

Take-Two has spent a month trying to identify the person or group leaking Grand Theft Auto VI, and it has done it almost entirely through an instrument that requires no lawsuit, no defendant and no hearing. Nobody has been sued. Nobody has been charged. What exists instead is a run of DMCA subpoenas filed in New York, one of which asked Discord to hand over the account details of everybody who had spoken in three servers since 1 June — not only the accounts tied to the leaks.

That scope is the story. The leaks themselves have been covered to death; the legal machinery behind the response has not, and it is a matter of public record rather than rumour. This piece sets out what was demanded, from whom, what the companies said back, and what the filings do not establish.

Nothing here links to leaked material, describes where to find it, or reproduces anything from it. The account handles and server invitations named in the filings are public, but they are not reproduced below for the same reason.

Where it stands

A DMCA subpoena is not a court ruling

This is the part almost every report skips, and it changes how the rest reads.

Section 512(h) of the US Copyright Act lets a copyright owner obtain a subpoena to unmask an alleged infringer from the clerk of a court, not from a judge deciding a case. The owner files a copy of a takedown notice, a proposed subpoena and a sworn declaration that the purpose is to obtain an infringer's identity and that the information will be used only to protect its rights. There is no complaint, no defendant, and no hearing at which the account holder can object first — in most cases the account holder never learns a demand was made.

So the filings are Take-Two asserting things, under oath, to get an administrative instrument issued. They are not a court agreeing that anyone infringed anything. The recipient can move to quash, and the limits are real: in RIAA v. Verizon the D.C. Circuit held in 2003 that §512(h) does not reach a provider acting as a mere conduit for traffic it does not store. Discord and Microsoft both store user content, which is why they are plausible targets where an internet provider would not be.

The practical difference is speed. A lawsuit against an unknown defendant takes months to reach discovery. A DMCA subpoena can issue within a day, which is precisely what happened here.

The sequence

The 27 August Extended Look went out in the middle of that, unchanged. Whatever the legal position, the marketing calendar did not move, and neither did the release date.

What was actually demanded

The Discord demand is the one worth reading closely. It sought all identifying information for all accounts that were members communicating in the listed servers "during the time period from June 1, 2026 to present", and it enumerated the fields: account ID, registration email, registration and last-login IP addresses, phone number, linked connections such as Google and Xbox, and associated device identifiers. From Microsoft it sought material relating to GTA, Rockstar or Cyberleek held in OneDrive accounts.

Six servers were listed. Three are attributable to the leaker's own operation. The other three are ordinary community servers, including one belonging to the long-running GTA streamer DarkViperAU. PC Gamer put the membership of two of them at roughly 5,600 and over 100,000 people.

Nothing in the filing distinguished a member who posted leaked footage from a member who said good morning in a general channel. The demand was framed by server membership over a fourteen-week window, and a request drawn that way sweeps in everyone who was there. That is what prompted the privacy criticism, and it is a fair reading of the document rather than an inference about intent.

The X application named three accounts. That one is narrow and uncontroversial by comparison: specific handles, alleged to have posted the material.

What the companies said

Discord was the only one to say anything substantive. Its marketing director, Ryan Rigney, wrote on X on 24 August that the company had not yet been served, and that when it was, it would "evaluate the validity and scope before responding". That sentence is doing more work than it looks. A provider that intends to comply in full does not usually flag scope in advance, and Discord was under public pressure from users of the two uninvolved servers at the time.

Microsoft has said nothing about the subpoena itself. An Xbox technology executive said separately that the company was working closely with Take-Two and Rockstar "to support efforts to protect creative works", which addresses the relationship and not the demand.

Google never had to respond. A judge declined to sign the YouTube subpoena without further information, and Take-Two withdrew the request on 28 August, saying it no longer needed the data and that the situation "has been (and is) evolving rapidly as new information becomes available".

Neither Discord nor Microsoft has confirmed producing anything. Absence of a statement is not compliance, and it is not refusal either — providers routinely neither confirm nor deny.

The second subpoena, and why it is sealed

The 28 August filing is the most informative document in the set, because Take-Two had to justify itself to get it.

It said the company had "identified one additional Discord user and obtained additional identifying information for a previously identified Discord user", and sought "more targeted information" about the servers already listed. It described the investigation as "rapidly evolving and ongoing". It asked for the subpoena to be sealed so as not to tip off the leakers. The court granted both, finding "good reason to issue an order directing the clerk to issue said subpoena".

Two things follow. The first is that the demand narrowed — the second request is targeted at individuals rather than framed by server membership, which suggests the first one produced something, or that the criticism landed, or both. The second is that the public record now stops. A sealed subpoena means the next development in this investigation will not be visible until somebody chooses to make it visible.

What it has achieved so far

By the only measure that matters to Rockstar, not much yet. The leaks continued after the subpoenas were served, and the identity of whoever is behind them has not been publicly established. Bloomberg's Jason Schreier reported that Rockstar staff were angry and frustrated, and that the studio was still working out how the breach happened — reporting, not a company statement, and Rockstar has never described the route the material took.

Set against 2022, the contrast is instructive. That leak was traced to a named individual within days, because the intrusion was noisy and the person behind it was boasting in public; it ended in a British courtroom and an indefinite hospital order, and the whole sequence is documented. This one is four weeks older than that one was at the point of arrest, and it is still at the stage of asking platforms who owns an account.

There is also a commercial layer that has no equivalent in 2022. GameSpot reported that a cryptocurrency token using the Cyberleek name appeared days before the first clip, and that the leaks have been used to run a pump-and-dump. That is reported rather than established in any filing, and it is not part of the copyright case, but it bears on motive: this leaker has been soliciting money, which the 2022 one did too, and it did not end well for him.

What is not confirmed

• That anyone has been identified. Take-Two says it has identified Discord users, which means accounts. Nothing on the record connects an account to a person.
• That Discord or Microsoft produced records. Neither has said so. The 4 September date was Take-Two's request, not a court-enforced deadline with a published outcome.
• That the leaker has or had a playable build. Outlets have inferred it from the footage and it is a reasonable reading, but Rockstar has confirmed nothing about what was taken.
• Any connection to the 2022 leak. Different actor, different material, no stated link.
• That anything will be filed publicly next. The live subpoena is sealed.
• That any of this affects the game. Rockstar's only statement was about spoilers. Nothing has been announced about the date, the content or the marketing, and the Extended Look shipped on schedule during the fortnight the subpoenas were issued.

What this means for you

Practically, almost nothing — unless you were in one of those servers, in which case your registration email and IP history were inside the scope of a demand you were never told about, for reasons unconnected to anything you did.

Everything else is unchanged. The material is still circulating, it still contains story content, and it is still the reason our spoiler guide exists. The defensive advice there is the useful response to a leak; a subpoena docket is not going to put footage back in a box.

If you want the game itself rather than the wreckage around it, the honest version is the published one: Rockstar's own stills and the twenty-six minutes it chose to show. Our map is built from that material and nothing else, and so is what we have on Jason Duval, the character the first leaked clip happened to feature.