Briefing Business Published New
Who leaked GTA VI? CyberLeek and the 2022 hacker, graded
Two leaks, two different stories. The 2022 hack that put early GTA VI footage online was carried out by Arion Kurtaj of the Lapsus$ group, a jury found, and he now faces a retrial. The 2026 leaks came from an anonymous account called CyberLeek, which used them to sell a memecoin. Take-Two is chasing it through the courts, and nobody has been arrested for it.
GTA VI has leaked twice, four years apart, and the two cases have little in common beyond the game. This page links to no leaked material and describes none of it.
Verdict: Confirmed: a UK jury found Arion Kurtaj carried out the 2022 Rockstar hack; he was given an indefinite hospital order in 2023. Inference, High confidence: he now faces a retrial in November 2026. Confirmed: CyberLeek posted GTA VI gameplay from 18 August 2026, and Take-Two is pursuing it with court subpoenas. Rumor, Very Low confidence: CyberLeek has been arrested.
Who leaked GTA VI in 2022?
Arion Kurtaj, a member of the Lapsus$ hacking group, a jury found in 2023. In September 2022 he got into Rockstar's systems from a hotel room where he was under police protection, using a phone, the hotel TV and an Amazon Fire Stick, and posted more than 90 clips of a game that hadn't been announced. Rockstar told the court it cost $5 million.
He was ruled unfit to stand trial, so the jury decided only whether he had done it, not whether he was guilty. In December 2023 he was given an indefinite hospital order.
What happened to the 2022 hacker?
He's been moved to a regular prison to face a retrial in November 2026, the month GTA VI launches, according to the BBC's Joe Tidy. Why he's now considered fit for trial hasn't been explained.
Who is CyberLeek?
Nobody outside the investigation knows. From 18 August 2026 an anonymous person or group calling itself CyberLeek posted GTA VI gameplay clips, taken from a playable build. It presented the leaks as a protest against digital pre-orders and paid add-ons while selling a cryptocurrency token with them. The posts stopped on 27 August, the day the Extended Look aired, after more than $200,000 of the token's earnings were withdrawn.
What is Take-Two doing about it?
Going to court, not to the press. In a New York federal court Take-Two asked Microsoft, Discord, X and YouTube for records that could identify the leaker. It later dropped the YouTube request and won a second, narrower Discord subpoena, kept sealed so as not to "tip off the alleged infringers". It hasn't sued anyone by name.
Has CyberLeek been arrested?
Not as far as anyone can show. The first arrest stories started when the leaks paused for a day in August, and the leaker posted again the next day. As of mid-September nobody had been arrested, charged or named, and no police force, court or Take-Two has said otherwise.
Is the 2022 breach still leaking?
Yes, in pieces. In September 2026 an archive of about 192GB from the 2022 breach began circulating, reported to hold files from a cancelled GTA V expansion and early GTA VI map work.
What changes this: an arrest, charge or lawsuit naming the 2026 leaker, or the outcome of Kurtaj's retrial.
Sources
References
Public sources used across this briefing. A source can support several claims and is listed once per role.
- TechRadar Reputable outlet https://www.techradar.com/gaming/gta-6-hacker-who-intended-to-return-to-cyber-crime-as-soon-as-possible-sentenced-to-an-indefinite-hospital-order
- TechSpot Reputable outlet https://www.techspot.com/news/113156-gta-6-hacker-who-sentenced-life-secure-hospital.html
- PC Gamer Reputable outlet https://www.pcgamer.com/games/grand-theft-auto/who-is-cyberleek-what-we-know-about-the-gta-6-leaker/
- Video Games Chronicle Reputable outlet https://www.videogameschronicle.com/news/take-two-says-its-investigation-into-the-gta-6-leaker-is-rapidly-evolving-as-it-requests-another-discord-subpoena/
- TheGamer Reputable outlet https://www.thegamer.com/grand-theft-auto-6-leaker-returns-new-video/
- PC Gamer Reputable outlet https://www.pcgamer.com/games/grand-theft-auto/with-gta-6-leaker-hunt-rapidly-evolving-take-two-asks-court-to-keep-latest-subpoena-request-sealed-to-avoid-tipping-off-leakers/
- GameSpot Reputable outlet https://www.gamespot.com/articles/gta-6-leaks-a-timeline-of-the-events-so-far/
- Cyber Magazine Reputable outlet https://cybermagazine.com/news/gta-vi-footage-leak-and-take-twos-legal-fightback-explained
- GAMINGbible (LADbible Group) Reputable outlet https://www.gamingbible.com/news/rockstar-games-leak-gta-6-dlc-surfaces-925474-20260918
- Dexerto Reputable outlet https://www.dexerto.com/gta/gta-6-might-get-liberty-city-dlc-as-massive-map-update-leaked-3410050/
Evidence
Claim record
This briefing is built on 7 classified public-record claims tracked by Vice Atlas — each one graded on its own, and re-graded as official sources land.
Open the claim record — 7 claims
- Confirmed Very High confidence
A UK jury found in 2023 that Arion Kurtaj, a member of the Lapsus$ hacking group, carried out the 2022 Rockstar hack that leaked more than 90 GTA VI clips; ruled unfit to stand trial, he was given an indefinite hospital order in December 2023.
- Confirmed Very High confidence
From 18 August 2026 an anonymous person or group called CyberLeek posted GTA VI gameplay clips from a playable build, used them to promote a cryptocurrency token, and stopped posting after more than $200,000 of the token's earnings were withdrawn on 27 August.
- Confirmed Very High confidence
Take-Two has pursued the GTA VI leaker in a New York federal court with subpoenas to Microsoft, Discord, X and YouTube, has withdrawn the YouTube one, and in late August 2026 obtained a second, sealed Discord subpoena.
- Confirmed High confidence
From mid-August 2026 an anonymous group posted unreleased Grand Theft Auto VI material online, including images presented as the full map; Take-Two responded with DMCA takedowns and, on 20 August 2026, a subpoena in the Southern District of New York seeking identifying records from Microsoft and Discord.
- Confirmed High confidence
In September 2026 an archive of roughly 192GB from the 2022 Rockstar breach began circulating online, reported to contain files from a cancelled Liberty City expansion for GTA V and early GTA VI map assets.
- Inference High confidence
Arion Kurtaj has been moved from a secure hospital to prison to face a retrial in November 2026.
- Rumor Very Low confidence
CyberLeek, the GTA VI leaker, has been arrested.
