Take-Two Subpoenas Microsoft and Discord Over GTA 6 Leaks

Take-Two Interactive has moved the investigation into the alleged Grand Theft Auto VI leaks into federal court. On August 20, the Rockstar Games parent company filed Digital Millennium Copyright Act (DMCA) subpoenas seeking information that could identify the person or group operating under the name Cyberleek. The action is an information-gathering step—not yet a copyright trial against an identified defendant.

The requests target Microsoft and Discord, two services that may hold records connecting the pseudonymous accounts to real-world identities or to the distribution of the leaked material. Both companies were reportedly given until September 4, 2026 to comply.

What Take-Two asked Microsoft to provide

The Microsoft subpoena reportedly seeks more than ordinary account-registration data. It asks for internal Microsoft business and investigative records connected to the company’s own inquiry into the Cyberleek persona, sufficient to identify the associated user, person, or entity.

Other reporting describes requests involving information tied to Microsoft services, including possible Xbox or OneDrive connections, as well as technical and identifying data such as IP addresses, phone numbers, linked accounts, device identifiers, and telemetry. The precise scope reported by different outlets varies, so those details should be treated as reported contents of the request rather than a confirmed account of what Microsoft will ultimately disclose.

The reference to Microsoft’s internal investigation is significant because it could reveal whether the leaked files passed through Microsoft services or whether the company identified a connection to an Xbox development environment. Reports have raised the possibility of an Xbox development-kit origin, but that theory remains unconfirmed.

What Take-Two asked Discord to provide

The Discord request reportedly seeks identifying and account information for accounts associated with posting or sharing the footage. The reported categories include handles, account IDs, registration details, IP-related information, communications, and other data that could connect online identities. It also covers users who belonged to specified Discord servers and channels where the material circulated.

Servers associated with GTA creator DarkViperAU were reportedly named in the filings. That does not establish that he leaked or distributed the footage. DarkViperAU has denied involvement, and appearing in a subpoena or having a server referenced in one is not itself evidence of wrongdoing.

What was leaked—and what remains unverified

Reports describe a series of at least six gameplay clips and purported map material appearing online over several days. The footage attributed to Cyberleek included scenes involving activities such as basketball, driving, combat, and flight, along with images said to show parts of the game world.

Take-Two’s use of copyright subpoenas and its efforts to remove or trace the material indicate that the company treats the clips as unauthorized proprietary content. They do not, by themselves, technically authenticate every video, image, or gameplay claim circulating online. Reporting has also suggested that the material may come from an unfinished or older build, which would make individual details especially difficult to treat as final game features.

Cyberleek presented the leak campaign as criticism of digital-only pre-orders and alleged day-one downloadable content practices. Those are claims or demands attributed to the anonymous account, not confirmed plans announced by Rockstar. The campaign also promoted a Solana-based CYBERLEEK memecoin. The token appeared shortly before or alongside the first widely reported leaks and experienced a sharp surge in attention and trading; several reports characterized the setup as resembling a pump-and-dump scheme.

Did the leaks hurt Take-Two’s share price?

The market impact is less settled than the legal response. Some reports claimed that Take-Two lost roughly $2.83 billion in market value over a period of less than two days as its share price fell after the leak reports.

That figure should not be presented as proof that the leaks alone caused the entire move. The available reporting does not establish a definitive causal link between the Cyberleek posts and every change in Take-Two’s stock price. Nor does the legal filing confirm that the leaked footage is authentic. The strongest conclusion is narrower: the leaks generated enough commercial and reputational concern for Take-Two to pursue platform records in federal court.

What happens after the September 4 deadline?

If Microsoft and Discord produce usable records, Take-Two may be able to connect Cyberleek accounts to email addresses, IP addresses, devices, payment trails, linked services, or communications. That could lead to additional subpoenas—including reported interest in Google—or to claims against identified individuals.

The process may also help investigators reconstruct how the files moved between platforms. But a subpoena does not guarantee that the requested information exists, that a platform can legally disclose all of it, or that the records will identify the original source. Reports also disagree on some procedural details, including the exact response date in certain secondary accounts; the more consistently reported deadline is September 4.

How the case fits Rockstar’s official GTA 6 reveal

The legal action arrived shortly before Rockstar’s planned Grand Theft Auto VI: An Extended Look. The presentation was scheduled to premiere on Netflix on August 27, 2026, before appearing later on Rockstar’s official YouTube channel and the GTA VI website.

Grand Theft Auto VI remained scheduled for release on November 19, 2026, for PlayStation 5 and Xbox Series X|S. As of the cited reporting, Rockstar and Take-Two had not publicly commented on the leak campaign itself. The subpoenas therefore represent the clearest documented public response: an attempt to identify the people behind the alleged distribution and protect the company’s copyrighted material, while leaving the footage’s full authenticity and the alleged breach pathway unresolved.