Take-Two has filed DMCA subpoenas aimed at Microsoft and Discord as it tries to identify the Cyberleek persona tied to recent GTA 6 leaks. Here is what the filings seek, how the trail connects, and what remains unproven.
Image: IGDB
Take-Two’s GTA 6 leaker hunt has moved from takedowns to subpoenas
Take-Two Interactive has filed DMCA subpoena requests in federal court seeking records from Microsoft and Discord tied to the recent spread of Grand Theft Auto 6 footage. The concrete development is narrow but significant: according to filings reported by Kotaku and covered by VGC, Rock Paper Shotgun, Eurogamer, Polygon, and Variety, Take-Two is asking platforms that may hold account, device, and communications data to help identify the person or people behind the Cyberleek persona.
The filings, lodged in the U.S. District Court for the Southern District of New York on August 20 according to multiple reports, frame the leaked material as copyrighted content. The subpoena language quoted by Kotaku, VGC, Eurogamer, and Rock Paper Shotgun says the material includes “audiovisual content, artwork, images, dialogue, or other creative elements.” Take-Two’s stated purpose, according to the same quoted filing language, is to obtain the identity of an alleged infringer or infringers, with the information used to protect Take-Two’s rights.
That distinction matters for how players should read this stage of the GTA 6 leak investigation. A subpoena request is not a court ruling that Cyberleek, any named Discord server, or any individual account holder is legally liable. It is a discovery move designed to turn online handles, platform activity, and linked services into identifying information. The legal outcome remains unresolved, and Rockstar and Take-Two had not publicly commented on the latest leak in the Rock Paper Shotgun report.
What Take-Two is asking Microsoft to hand over
The Microsoft side of the Take-Two subpoena focuses on the Cyberleek persona and Microsoft-controlled services that could connect a leak trail across GitHub, Xbox, and OneDrive. Variety reported that Take-Two’s Microsoft subpoena says GTA 6 copyrighted content was posted to Microsoft’s GitHub developer platform. Polygon likewise noted that Take-Two is using the DMCA process to seek identifying information involving Discord, GitHub, and possible connections to services such as OneDrive, Google, and Xbox accounts.
The language quoted by Kotaku, VGC, Rock Paper Shotgun, Eurogamer, and Polygon asks Microsoft for “all internal Microsoft business records and investigative records associated with Microsoft’s internal investigation of the ‘cyberleek’ persona sufficient to identify the user(s), person(s) and/or entity/ies associated with that persona.” Several reports say Microsoft was given a September 4 deadline, with Polygon specifying Sept. 4 at 10 a.m. EDT.
The requested categories are broad. Reports quote the filing as seeking account IDs, registration emails, registration and last-login IP addresses, phone numbers, linked connections such as Google or Xbox, device identifiers such as MachineGuid or MSA, and OneDrive content related to Grand Theft Auto, Rockstar, or Cyberleek. In practical terms, Take-Two appears to be trying to connect the visible leak identity to a chain of infrastructure: where files were stored or posted, what accounts touched them, which devices may have been associated, and whether linked services point to a real-world person or entity.
That does not mean Microsoft has already identified the leaker, nor that all requested data will necessarily be produced as requested. The sources establish what Take-Two is seeking and the reported deadline, not what Microsoft will ultimately hand over or whether the records will identify a responsible party.
What Take-Two wants from Discord, and why the request is sensitive
The Discord subpoena is aimed at accounts and servers that Take-Two believes may be connected to the circulation or organization of the GTA 6 leaks. Polygon reported that Take-Two believes it has identified Discord handles for Cyberleek, including CYBERLEEK and CINEMATICROCKSTAR, and servers such as Ødyssey.gg where the hacker allegedly operated. Kotaku reported that Discord was asked for records involving servers and names including “CYBERLEEK,” “CINEMATICROCKSTAR,” “Surfer24k™” and replacement handles, “Ødyssey.gg,” the “‘! Odyssey’ public brand guild,” and the “DarkViperAU editors’ server.”
The scope, as quoted across the reports, covers identifying information for accounts that were members or communicating with listed Discord servers during the period from June 1, 2026 to the present. Polygon’s quoted language says Take-Two requested backend server metadata or telemetry records, original message logs, IP access logs, email addresses, phone numbers, connected accounts, registration timestamps, linked connections, and device identifiers. Kotaku and other outlets also quote language asking for associated device or telemetry records where specified tool or file artifacts were present.
This is the most delicate part of the Microsoft Discord subpoena story because membership in, or communication within, a server is not the same thing as authorship of a leak. Rock Paper Shotgun reported that one listed server belongs to Australian GTA YouTuber and streamer Matthew Judge, known as DarkViperAU. Judge wrote on X that he was confused, saying Rockstar had not emailed him and that if the company thought he personally knew something, he suspected it would contact him. His server being named in a subpoena request does not establish wrongdoing by him or by ordinary members of that community.
Variety received a statement from a Discord spokesperson saying Discord sometimes receives DMCA-related subpoenas and reviews and complies with valid subpoenas as standard practice. That is a procedural statement, not a confirmation that any specific user data has already been turned over.
How Cyberleek connects the legal filings to the leaked GTA 6 clips
Across the reporting, Cyberleek is the handle or persona at the center of the current Rockstar GTA 6 leak trail. VGC described the individual as appearing to share confidential clips and materials related to GTA 6 in exchange for promotion of a cryptocurrency. Eurogamer reported that CyberLeek has claimed to be leaking in the name of gamers’ rights, while also pointing to a $CYBERLEEK meme coin scheme in which people were encouraged to buy the coin to vote for new video leaks. Polygon separately reported on the group’s cryptocurrency ties and alleged financial angle.
The strongest supported connection is behavioral and account-based rather than adjudicated. Reports say clips circulated across the internet over several days, takedowns followed, and new footage continued to appear in new locations. Variety reported that multiple alleged GTA 6 gameplay videos had been released by a hacker group calling itself CyberLeek, which claimed to have obtained a playable build of the game. Eurogamer reported that one video showed co-protagonist Jason in Vice City and that earlier footage of Jason shooting the word “leek” into a wall suggested some kind of playable access.
Those are reports about claims and visible leaked footage, not confirmation of how the material was obtained. Take-Two’s subpoena language seeks to identify alleged infringers tied to copyrighted material. It does not, by itself, prove whether the source was a hack, an insider leak, unauthorized access to a build, compromised cloud storage, or some other chain of custody. The filings are built to answer that strategic question by chasing the identity layer behind the public persona.
The company strategy is containment first, identification second
From a strategy perspective, Take-Two’s response follows a familiar escalation pattern for a publisher facing a high-value leak. The first move is removal: takedown requests, deleted videos, and attempts to stop reuploads from shaping the public conversation. Polygon reported that Take-Two had been working during the week to take down as many leaks as possible, even as Cyberleek’s threat to release more continued. Rock Paper Shotgun similarly described several days of takedowns while more clips appeared online.
The second move is identification. That is where Microsoft and Discord become important. GitHub can host files or repositories, Xbox and Google links can connect identities across services, OneDrive can hold content, Discord can preserve server activity and account metadata, and device identifiers can potentially tie activity back to machines rather than throwaway handles. Take-Two’s request is broad because the leak economy is fragmented: a clip can surface on one site, be discussed on Discord, stored in a cloud account, reposted through another identity, and monetized through a crypto promotion elsewhere.
For Take-Two and Rockstar, the business incentive is obvious from the source material without needing to speculate beyond it. GTA 6 is approaching launch, with Kotaku describing the leaks as arriving ahead of a November release and Variety saying they came more than three months before release. Leaked footage can distort impressions of an unfinished or controlled build, disrupt marketing beats, and create security pressure around every partner platform that touched the material. The subpoenas indicate Take-Two is now treating the leak as an identity problem, not only a moderation problem.
What players should do while the GTA 6 leak investigation continues
For players, the safest read is simple: the filings confirm a serious legal effort by Take-Two, but they do not confirm who Cyberleek is, how the footage was obtained, or whether any named community member committed wrongdoing. The current public record supports that Take-Two has requested identifying data from Microsoft and Discord under the DMCA, that the requests target alleged infringers tied to GTA 6 copyrighted material, and that the Cyberleek persona is central to the investigation.
Players should also be cautious around files claiming to be leaked GTA 6 builds. Rock Paper Shotgun specifically advised regular users to avoid downloading files claiming to be leaked GTA 6 builds, and that is sound practical guidance. A leak wave creates ideal conditions for malware, impersonation, fake executables, and social engineering, especially when the alleged leak campaign is already tied in reports to crypto promotion and account-hopping.
There is no new official gameplay feature, platform expansion, price, PC plan, or performance information established by these subpoenas. Eurogamer’s article page lists Grand Theft Auto VI for PS5 and Xbox Series X/S, and the same source embeds Rockstar’s second official trailer, but the legal filings themselves are about identifying alleged infringers, not changing release details. Until Rockstar or Take-Two comments publicly, players looking for reliable GTA 6 information should separate official trailers and publisher announcements from leaked clips, reposted footage, and claims attached to Cyberleek-branded accounts.
The next practical marker is the reported September 4 production deadline for Microsoft and Discord. Even if records are produced, that may not immediately translate into a public answer. Legal identification, platform compliance, and any follow-up claims can move slowly, and the absence of a public update would not mean the investigation has stalled. For now, the confirmed story is that Take-Two has shifted from chasing clips across the internet to asking the platforms behind the accounts for data that could reveal who was driving the leak campaign.