GTA 6 Leak Fallout: Rockstar Faces Court Orders as Cyberleak Demands Pay

The situation around GTA 6 continues to escalate, with new claims about who leaked information, how the breach is being investigated, and what internal fallout is happening at Rockstar Games. Since the latest leak surfaced online—showing Jason stealing a sports car and driving through Vice City—more developments have followed in quick succession, spanning court orders, digital forensics, and separate reports of another intrusion.

Quick facts

• Take-Two lawyers sought court orders requiring Microsoft and Discord to provide data tied to the leaker.
• The requested information includes personal details, IP addresses, and OneDrive disk contents associated with Cyberleek.
• Xbox technical director Scott Van Vliet confirmed Microsoft’s involvement in the investigation.
• Players traced cryptocurrency activity to KuCoin, where identity verification (KYC) could help identify the suspect faster than law enforcement.
• Rockstar staff morale is described as poor after a new leak, despite earlier security changes following a prior incident.
• Rockstar and Take-Two are not reportedly planning to change the planned August 27 event or move marketing strategy immediately.
• A second leak tied to “808 Mafia” involved phishing and console files (Xbox Graphics Capture) with telemetry data and 3D models.
• Cyberleek updated its website with a contact page and a proposal for paid “exclusive content,” asking for $164,000 in Monero—though the site is currently blocked.

Courts move: data demands tied to Cyberleek

Legal pressure is now part of the GTA 6 leak story. A specialist reporter focused on Rockstar Games issues claims that Take-Two’s attorneys obtained orders from a New York court compelling Microsoft and Discord to hand over identifying information connected to Cyberleek.

Those orders reportedly cover personal data, IP addresses, and the contents of OneDrive storage associated with Cyberleek. Xbox’s technical director, Scott Van Vliet, is said to have confirmed participation in the investigation.

Players’ parallel hunt points to KuCoin

While the legal process unfolds, a separate track is being pursued by players who are analyzing the hacker’s financial trail. The community reportedly followed the leaker’s cryptocurrency movements and traced them to the exchange KuCoin.

Because KuCoin uses KYC identity verification, the community believes it may be able to determine the suspect’s real-world identity more quickly than police can—at least in terms of who can be tied to the relevant accounts.

Rockstar staff morale described as “fatal” after the next breach

Alongside the investigation, reports claim Rockstar Games is dealing with internal frustration. Jason Schreier is cited in the narrative as describing “fatal” morale at the studio following the newest leak.

The context matters: after a prior leak in 2022, Rockstar reportedly required staff to return to the office five days a week. The current wave of leaks has reportedly angered employees because the earlier security reset did not prevent another breach.

Netflix presentation remains on track for August 27

Rockstar leadership is also reportedly trying to steady morale with messaging to employees. An internal note sent to staff is described as assuring them that the planned showcase on August 27—linked to Rockstar and Take-Two—is not expected to change, even though the presentation is set to be on Netflix.

That same reporting also says Rockstar has not identified who is responsible for the newest leak, nor has it determined how the latest security incident occurred. The company is also said not to be planning an immediate shift in marketing strategy, and there are no reported plans to delay the scheduled gameplay reveal.

Second major leak: 808 Mafia and Xbox Graphics Capture

The situation worsens further with a separate, independent leak attributed to a group referred to as 808 Mafia. The claim is that a phishing attack resulted in access to files from a console system—specifically Xbox Graphics Capture.

Those captured files are described as containing telemetry data and 3D models. Players are already using that material to reconstruct parts of a new map layout, and the report points to a prior news update for additional details.

Cyberleek’s site attempt: $164,000 Monero pitch, now blocked

Another wrinkle came from Cyberleek itself. The leaker updated a website that reportedly included a contact page, ad space, and an offer to publish exclusive content in exchange for payment.

The proposed price is listed as $164,000 in Monero, a cryptocurrency designed so users and transactions are kept anonymous. However, the report states that nothing is currently active because all of Cyberleek’s sites have been blocked; attempting to access them reportedly shows only a generic notice.

Work still ongoing for GTA 6

Finally, the reporting emphasizes that GTA 6 is not finished. Rockstar is said to continue development through to the game’s eventual release, even as the studio faces repeated attempts to expose unfinished work.