- Grand Theft Auto VI
- Updated 2026-09-18
- News
The GTA 6 Leaks: 2022, 2026 and What the Courts Decided
Three separate breaches, one indefinite hospital order, a memecoin, and a set of subpoenas that can name you without anyone filing a lawsuit. Here is what actually happened — and why none of the leaked footage tells you much about the game shipping in November.
- Major breaches
- 3
- 2022 videos leaked
- ~90
- Cost to Rockstar
- $5M
- Rockstar comment on content
- None
- Arrests in 2026 case
- 0
- Delays caused
- 0
What this page does and does not do
This page reports on the leaks as news events: what happened, who did it, what the courts decided, and what the legal position is now. It does not host, embed, mirror or describe the leaked footage as if it were information about the finished game. That is a deliberate editorial decision and section 05 explains why it is also the only sensible one for any site that wants to stay online.
September 2022: the Rockstar network intrusion
On Sunday 18 September 2022, a user calling themselves teapotuberhacker posted around 90 videos of in-development GTA 6 footage — roughly fifty minutes in total — to a thread on GTAForums. Mirrors reached Twitter, YouTube, Reddit and Telegram within hours.
Rockstar confirmed it the next day. The statement is worth quoting because of one phrase in it:
Rockstar Games, 19 September 2022
“We recently suffered a network intrusion in which an unauthorized third party illegally accessed and downloaded confidential information from our systems, including early development footage for the next Grand Theft Auto… We are extremely disappointed to have any details of our next game shared with you all in this way.”
Take-Two filed the same language in an SEC Form 8-K on 19 September 2022 — which makes it a legally-filed corporate statement rather than a PR line. Both said they anticipated no long-term effect on development.
Who did it
| Item | Detail |
|---|---|
| Group | Lapsus$ — also behind intrusions at Nvidia, Microsoft, Samsung, Okta, BT, EE, Revolut and Uber |
| Individual | Arion Kurtaj, from Oxfordshire. 17 at the time of the hack, 18 by the trial |
| Method | Social engineering. Posing as employees requesting password resets, using contractor credentials, reaching Rockstar’s internal Slack and Confluence |
| Where he did it from | A Travelodge hotel room in Bicester, while on bail and under police protection, using an Amazon Fire TV Stick, the hotel television and a phone |
| Arrest | City of London Police raided the room on 22 September 2022 |
| Cost to Rockstar | $5 million to recover, plus “thousands of hours” of staff time, as told to the court |
The detail almost every article gets wrong
Kurtaj was not convicted. He was assessed with acute autism and found unfit to plead, so there was no criminal trial. Instead the court held a “trial of the facts” under the Criminal Procedure (Insanity) Act 1964, where the jury decides only whether the defendant did the act — there is no conviction and no finding of guilt. On 23 August 2023 the jury found he did the acts in relation to twelve offences. His 17-year-old co-defendant, who was fit to plead, was convicted.
Sentencing, 21 December 2023: an indefinite hospital order with restrictions under the Mental Health Act — detention in a secure hospital, releasable only if clinicians judge he is no longer a danger. The court heard he had “continued to express the intent to return to cyber-crime as soon as possible”. The co-defendant received an 18-month youth rehabilitation order.
Where he is now, as of September 2026: BBC cyber correspondent Joe Tidy reported in July 2026 that Kurtaj has been moved out of the secure hospital into an ordinary prison and is awaiting a conventional criminal retrial listed for November 2026 — implying he has since been assessed as fit to plead. No court or police statement has confirmed this publicly, so we are attributing it rather than stating it.
2026: two more breaches, one much bigger
April 2026 — ShinyHunters and the supply chain
The extortion group ShinyHunters claimed around 11 April 2026 that it had reached Rockstar’s Snowflake data warehouse using authentication tokens stolen from Anodot, a third-party cloud cost-monitoring vendor. A supply-chain compromise, not a direct intrusion. Rockstar confirmed that “a limited amount of non-material company information” was accessed through a third party, with no impact on players and no passwords or personal data involved. No public dump ever followed.
August 2026 — CyberLeek, the biggest since 2022
From 18 August 2026, an entity branding itself CyberLeek began releasing a rolling series of roughly fifteen GTA 6 gameplay clips plus detailed maps of Leonida. The evidence suggested possession of a playable build rather than captured video — at one point the leaker shot the word “Leek” into a wall with gunfire.
The part that makes this one different
CyberLeek was not a hacker dumping files. It was a monetised campaign: a manifesto opposing digital-only releases and pre-orders, attached to a Solana memecoin. Token holders voted on which footage dropped next, and market-cap thresholds unlocked clips. Watermarks read “BUY $CYBERLEEK ON SOLANA” and “No physical discs? Then more leeks!”
The campaign group Stop Killing Games, whose cause the manifesto claimed to borrow, publicly distanced itself: “Using illegal means to make a point is unacceptable to us.”
Rockstar broke a week of silence on 26 August 2026, the day before the Extended Look premiere: “It would be an understatement to say that having videos of Grand Theft Auto VI gameplay leak in this way has been heartbreaking for our team, and this is obviously not how we intended for you to see the game after all this time… we hope that everyone will wait a bit longer to experience the game for themselves on November 19.”
As of today, nobody behind CyberLeek has been identified, no arrest has been reported, and the activity stopped after the official presentation. No delay to the 19 November release was announced.
The legal response, and why it matters to you
In August 2026 Take-Two went considerably further than takedown notices. Filed in the US District Court for the Southern District of New York on 20–21 August 2026, prepared by Kirkland & Ellis: DMCA §512(h) subpoenas against Discord, Microsoft, X Corp and Google/YouTube.
| Target | Sought |
|---|---|
| Discord | Identifying data for every account that posted in three named servers since 1 June 2026 — a breadth that drew criticism as potentially overbroad |
| Microsoft | Device IDs, and data in its capacity as GitHub’s provider; OneDrive contents |
| X Corp, Google/YouTube | IP addresses, registration emails, phone numbers, linked accounts |
The mechanism matters: §512(h) lets a rights holder compel a service provider to identify users without first filing a lawsuit. Responses were due 4 September 2026; no outcome has been announced publicly.
For context on how seriously this is pursued: the 2022 material is still circulating on mirrors and archive sites despite four years of takedowns, and Take-Two has never stopped enforcing against it.
What the leaked footage showed — and why it proves little
Press reporting at the time described the 2022 clips as looking like QA bug-report captures. One source told PC Gamer that most of the videos “would likely have been attached to bug reports from QA testers”. Reported artefacts included mannequin-style NPCs clipping through objects, visible debug overlays and camera-tracking tools, placeholder dialogue strings such as Jason: GENERIC_CURSE_TO_SELF, and recycled GTA V assets relabelled — police cars marked “V.C.P.D.”
The material did corroborate two things later confirmed officially: a Vice City setting, and two protagonists named Jason and Lucia, one of them a playable woman — a series first.
The line Rockstar has never crossed
In 2022 Rockstar authenticated the footage only as “early development footage”. In 2026 it said the leaks were heartbreaking and referred vaguely to “spoilers”. Neither Rockstar nor Take-Two has ever commented on a single feature, character or mechanic shown in any leak. The footage is confirmed genuine. It has never been confirmed representative, and there is a four-year gap between the 2022 clips and a game shipping this November.
Journalists noted one wordless response: the official Extended Look deliberately re-showed a diner robbery sequence that had appeared in the 2022 leak, in a far more finished state. Read as a rebuttal. Never stated as one.
Why we do not publish the footage
Three reasons, in order of how much they should worry a publisher.
- It is legally hot, right now. The material is unpublished copyrighted work owned by Take-Two, obtained through a criminal intrusion, never licensed. Take-Two is actively pursuing the identities of people who posted it, through subpoenas that do not require a lawsuit first. Hosting or embedding it is not a grey area
- It is bad information. Pre-alpha QA captures with placeholder assets, four years out from release, which Rockstar has never confirmed as representative of anything. A guide built on it is a guide built on sand
- It is a malware vector. In August 2026 a fake “113 GB GTA 6 build” circulated that was 99.99% empty padding wrapped around a roughly 50 KB trojan which disables Windows Defender. This is the normal condition of the ecosystem that distributes this material
What we do instead
We report the leaks as news, quote what press and courts documented, and link to the reporting. For what the game actually contains we use the official Extended Look — which is twenty-seven minutes long, in final-quality form, and legal to discuss in as much detail as you like.