Rockstar Games

Summary

Rockstar Games experienced a leak of Grand Theft Auto VI gameplay footage by the online persona CyberLeek, who claimed the release protested the lack of physical copies while watermarking the videos with cryptocurrency wallet addresses indicating a financial motive. Take-Two Interactive responded by filing Digital Millennium Copyright Act subpoenas against Discord, Google, Microsoft and X to obtain identifying information of the accounts sharing the footage, with courts granting the requests for Discord, Microsoft and X but not for Google. The leaked material continued to appear online daily, prompting further legal notices and causing the hosting sites associated with the leak to go offline, while the incident drew significant public attention and highlighted the blend of hacktivist posturing with monetization tactics in intellectual property theft.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The incident began when the online persona “CyberLeek” published gameplay footage of Grand Theft Auto VI approximately one week before Take-Two Interactive Software planned to reveal core portions of the game to the public. The leaked files suggested either direct hacker access to Rockstar Games’ most sensitive systems or the receipt of proprietary data from an insider. CyberLeek claimed the release was a protest against Rockstar’s decision not to offer physical copies of the game, yet watermarks on the videos contained cryptocurrency wallet addresses, indicating a financial motive. The persona also launched a cryptocurrency token, embedded buy‑links in the stolen footage, and offered to sell advertising space on future leaks, with payouts tied to viewership numbers. An anti‑corporate manifesto targeting digital pre‑orders and disc‑less releases accompanied the leaks, which observers described as a blend of hacktivist rhetoric and monetization efforts.

In response, Take-Two filed petitions for subpoenas under the Digital Millennium Copyright Act seeking the identities of CyberLeek and associated accounts from Discord, Google, Microsoft, and X. Federal judges granted the subpoenas against Discord, Microsoft, and X, while the request targeting Google remained unapproved as of the reported Monday. Take-Two’s legal team also sent copyright notices to the four platforms concerning the infringing material. The company did not provide a public comment on the matter. Following the legal actions, the websites where those behind CyberLeek had posted the leaked footage and links to a memecoin were taken offline. Take-Two additionally sought extensive data from Discord, including Windows device identifiers, login records, and cloud storage contents for every user who had participated in three specific Discord servers dating back to June.

The leak intensified public and industry scrutiny of the unreleased title, amplifying both interest and risk. Take-Two’s parent company emphasized the heightened financial and reputational stakes due to the game’s anticipated audience, noting that Grand Theft Auto V had sold over 230 million copies and generated more than $11 billion since 2013, with projections for Grand Theft Auto VI ranging from $3.3 billion to $5.2 billion in launch‑week sales. The incident echoed a prior 2022 security event in which an 18‑year‑old member of the Lapsus$ gang was sentenced to an indefinite hospital order after leaking gameplay footage, a breach that cost Rockstar, Uber, and Nvidia over $10 million. Observers drew parallels to earlier intellectual‑property thefts, such as the 2014 Sony Pictures attack and the 2017 HBO hack, as well as to Iranian threat actors who leaked Game of Thrones episodes in a hacking‑for‑hire scheme. The response was characterized as resembling an insider‑threat investigation, with the possibility that the leaker had obtained an actual game build, saved it to a cloud service, uploaded it to a file‑hosting site, or removed it on an external drive. The widespread dissemination of the footage created an unintended underground marketing effect while simultaneously exposing the perpetrators to legal risk.

Sources

Sources available to members: 1 source.