GTA VI and The Last of Us Part 2: Leak Fallout Explained

Game leaks and hacks have become an ugly through-line in modern video game history, turning long-term development surprises into public property—sometimes with legal fallout, sometimes with entire studios blindsided. From early source-code heists to high-profile ransomware demands, the pattern is familiar: attackers steal internal material, then force the industry to react in real time.

GTA VI: a leak that pushed Rockstar into confirming the project

Rockstar Games has now dealt with a major leak involving Grand Theft Auto VI for a second time, and the story began long before the game’s public roll-out. On September 18, 2002, a user posted about 90 videos containing very early internal development footage on GTA Forums, at a moment when Rockstar hadn’t officially indicated it was working on a new entry in the franchise.

The attacker was later identified as Arion Kurtaj, a member of the hacking group Lapsu$. He was able to break into Rockstar’s internal systems from a hotel using an Amazon Fire TV Stick, a television, and a phone—enough access to claim he had the skills of a thief. A member of Rockstar India was listed as the victim, and the leaked material confirmed a large amount of information about the project.

Those leaks effectively established that GTA VI existed, that it would feature two playable protagonists, and that development was tied to Vice City—along with other possibilities and features that still weren’t officially confirmed at the time. The result was that Rockstar Games had to announce that it was indeed working on a new installment in the series.

Even after that lesson, another incident struck roughly three months before GTA VI’s launch. Another hacking group reportedly accessed a playable build from 2025 and posted multiple short videos showing features that, when they went up, had not yet been officially shown. The fallout has remained a defining chapter in how leaks can keep escalating rather than ending.

Quick scan: major leak flashpoints

September 18, 2002: About 90 early GTA VI development videos appear online before any official confirmation.
Attacker identified as Arion Kurtaj of Lapsu$: accessed Rockstar systems from a hotel using an Amazon Fire TV Stick, TV, and phone.
2025 build leak: another group allegedly posted short videos showing features not yet officially revealed.
April–May 2020: The Last of Us: Part II story spoilers circulate online after access to Amazon-stored files.
Valve’s 2003 incident: Half-Life 2 source code leaked following a hack, enabling an unofficial playable build.
December 12, 2023: Rhysida ransomware attack on Insomniac Games demanded two million bitcoin in seven days.
May–July 2020: 4chan posts reveal internal Nintendo material including source code for multiple consoles.
2021: CD Projekt RED suffers theft of code tied to Cyberpunk 2077, The Witcher 3, and Gwent.

The Last of Us: Part II: spoilers arrive before launch

In the months of April and May 2020, multiple videos surfaced online that revealed the full story of The Last of Us: Part II before the game released. That included the ending and other controversial plot developments, wiping away the element of surprise the narrative was built to deliver.

The method this time involved a vulnerability discovered in earlier Naughty Dog games, which then gave the attackers access to Amazon servers holding the relevant game files. Around 1 TB of data reportedly was stolen, including internal Naughty Dog information such as the level list and story details—exactly the kind of material that makes story-driven games feel “spoiled” even if players don’t watch every clip.

Half-Life 2: the source-code theft that defined modern leaks

Before these more recent incidents, a landmark case hit in October 2003. Valve discovered that Half-Life 2 source code had been leaked after an intrusion into the company’s servers.

The person responsible was Axel Gembe, an 18-year-old German, who reportedly found a blank-password account on Valve’s network that granted access. With that access, he downloaded the code, a large set of assets, and enough additional material to create an unofficial playable build of Half-Life 2, which then spread online before the sequel launched.

Valve confirmed the attack occurred on the same day and estimated the damage at roughly 250 million dollars. The incident also became a legal precedent for how these cases are treated as intellectual property theft. Gembe was sentenced to prison.

Insomniac’s ransomware crisis: two million bitcoin demanded

On December 12, 2023, a hacking group called Rhysida breached Insomniac Games. The demand was a payment of two million bitcoin within seven days, with a threat to publish whatever the group had accessed.

PlayStation, which owns the studio, refused to pay. After that, the group released 1.67 TB of data—over a million files—online. The exposed contents included a playable build for Marvel’s Wolverine (not yet officially announced at the time), studio release plans extending to 2035, and numerous unannounced titles, plus budget information for each project.

The leak also included personal data from multiple Insomniac employees, such as tax forms, internal emails, payroll information, and Slack conversations—along with other documentation. At the time, it was described as the largest attack ever carried out against a development studio, and the damage extended beyond Insomniac and PlayStation into broader future planning.

Nintendo and the alleged biggest source-code leak in history

Nintendo has also been tied to one of the most significant information dumps in game history. Between May and July 2020, anonymous users posted large amounts of internal data on 4chan, culminating in the publication of source code for multiple systems, including Nintendo 64, GameCube, Wii, and Game Boy Color.

Beyond console code, complete games were also reportedly leaked, including Super Mario 64 and The Legend of Zelda: Ocarina of Time. The material also allegedly included prototypes of canceled projects such as Star Fox 2, an MMO concept for Pokémon, and development tools.

This was widely framed as the biggest internal information leak in the history of the medium, because it revealed decades of Nintendo development work, including material reportedly dating back to the late 1980s.

Why this keeps happening: leaks are more common than they look

While a high-profile story like GTA VI can make leaks feel shocking, the reality is that large-scale breaches have been recurring for years. In 2021, CD Projekt RED suffered a similar attack in which code tied to Cyberpunk 2077, The Witcher 3, and Gwent was reportedly stolen. The stolen code was then reportedly put up for auction after the studio didn’t agree to pay a “ransom.”

For studios, the problem is hard to eliminate entirely—even big companies with major security budgets. For players, the consequences are typically negative: leaked information often benefits attackers rather than the community, and spoilers or exposed assets can undermine the experience the games are meant to deliver. The industry’s hope is that these events don’t keep adding new chapters.