GTA 6 Leak Hunt: Take-Two’s Sealed Discord Subpoena

Take-Two Interactive has made a more targeted move in its effort to identify the person or people behind the recent unauthorized Grand Theft Auto VI material circulated online. On August 28, 2026, the publisher requested a second Digital Millennium Copyright Act subpoena directed at Discord in the U.S. District Court for the Southern District of New York. Unlike its first request, the new filing asks the court to keep the attachment containing the specific information demands under seal. The public filing does not identify the additional Discord account or disclose the precise records Take-Two wants from the platform. That secrecy is central to the request, not a side issue: Take-Two argues that publishing the attachment could reveal the direction and progress of its investigation to the alleged infringers.

The development confirms the central point of the Eurogamer report: the legal pursuit has not stopped at broad initial requests. It has shifted toward named or otherwise more specifically identified targets. However, the legal record also makes clear that this is still an identification process, not a public lawsuit against a confirmed individual. A DMCA subpoena is a mechanism through which a copyright owner can seek information sufficient to identify an alleged infringer from a service provider. It does not itself determine that a person infringed copyright, establish who leaked material, or award damages. Those distinctions matter when discussing a story that has generated intense attention, strong reactions from fans, and a considerable amount of unverified online commentary.

What Take-Two filed on August 28

The public request is titled In re DMCA Subpoena to Discord, Inc., case number 1:26-mc-422. It was filed by attorneys from Kirkland & Ellis on behalf of Take-Two Interactive Software, Inc. The filing asks the clerk to issue a subpoena under 17 U.S.C. § 512(h), the DMCA provision that permits copyright holders to seek the identity of alleged infringers from service providers. Take-Two describes Discord as the provider for accounts and servers on which it says infringing content was posted. It states that the content at issue infringes copyrights in Grand Theft Auto VI, which the filing calls proprietary software owned by Take-Two.

The second request says Take-Two has identified “one additional Discord user” and obtained further identifying information for a Discord user that was already included in the first request. It also says the company has obtained additional information about community servers identified in the earlier subpoena and now seeks more targeted information. The filing does not publicly name the user, provide a username, or enumerate the servers in the new attachment. That is because the attachment was the sole portion Take-Two asked to seal. The request did not seek to hide the entire case, the existence of the new subpoena application, or the company’s stated justification for pursuing it.

That limited scope is important. Take-Two’s sealing motion says that it seeks leave to file only the subpoena attachment under seal, rather than the complete filing. In the company’s framing, the attachment contains “narrowly tailored and specific document requests.” The company argues that the material contains sensitive information about an ongoing copyright-infringement and confidential-information investigation. It also argues that discovery material of this kind is not necessarily subject to the same presumption of public access as material central to a court’s adjudication. Whether the court agrees remains a separate question; at the time of reporting on August 31, the court had not yet ruled on whether the sealed treatment would continue, and the second subpoena had not yet been issued.

Why the new request is being kept from public view

Take-Two’s stated rationale is evidentiary and investigative. Its sealing letter warns that public disclosure could compromise the investigation by showing alleged infringers what Take-Two has learned, whom it is examining, and what information it is seeking. The company says that disclosure could create a substantial risk that evidence would be deleted, destroyed, concealed, or that further efforts would be taken to avoid identification. This is an argument made by Take-Two’s lawyers to the court, not a court finding that evidence has been destroyed or that any named person has committed wrongdoing. The difference is especially significant because the relevant attachment is not public.

“Public disclosure of this information could compromise Take-Two’s ongoing investigation.”

The language illustrates why this second filing is materially different from the earlier public-facing requests. A public subpoena can show the community which usernames, servers, accounts, files, or records are being sought. A sealed attachment denies the public that map. In practical terms, that means observers can report the existence of a tighter Discord request without responsibly claiming to know its full target list or the exact categories of data requested. Any social-media post purporting to identify the new targets should therefore be treated with caution unless supported by a subsequently unsealed court document or a credible on-the-record source.

Sealing also creates a tension that courts routinely have to manage: the public interest in access to judicial materials versus the need to protect an active investigation. Take-Two cited Second Circuit and Southern District of New York decisions in support of its position that the relevant attachment has little or no public-access presumption and that the proposed sealing is narrowly drawn. The company’s motion does not ask the public to accept its position automatically; it asks Judge Andrew L. Carter Jr. to grant leave to file the attachment under seal. Until the court rules, the outcome should not be presented as settled.

From the first Discord request to a narrower lead

The new filing places its own timeline on the record. Take-Two says the court granted its first Discord subpoena request on August 21, 2026, that the clerk issued the subpoena the same day, and that it was promptly served on Discord. The first request, according to the August 28 filing, sought different information and included a user ID that the second request now clarifies. The company characterizes the investigation as “rapidly evolving and ongoing,” a description that explains both the changed scope and the decision to return to court only a week later.

There is, however, an unresolved public discrepancy about service of that earlier subpoena. On August 24, Discord marketing director Ryan Rigney said that Discord had not yet been served with a subpoena from Take-Two and that the company would evaluate the validity and scope before responding if served. TorrentFreak later noted that Take-Two’s August 28 filing says prompt service occurred, while the public docket did not separately display a clerk issuance or proof of service. These statements may reflect timing, docketing practices, or another explanation, but the available public reporting does not resolve the difference. It would be inaccurate to say publicly that Discord has produced data, refused the request, or completed its evaluation.

“When we do, we’ll evaluate the validity and scope before responding.”

The first Discord request attracted particular scrutiny because reporting described it as broad. TorrentFreak said it sought identifying details associated with every account that communicated in three named Discord servers from June 1, rather than only accounts directly accused of uploading a leak. The same reporting said the demand sought identifying information for accounts that were members of the listed community servers and channels. That breadth matters because membership in a community space, viewing posts, discussing a leak, reposting material, and originating copyrighted material are not equivalent actions. The new request’s language suggests Take-Two has moved from that initial landscape toward more specific accounts and server information, but the sealed attachment prevents an outside assessment of exactly how narrow the second demand is.

What a DMCA subpoena can and cannot establish

Section 512(h) of the DMCA lets a copyright owner, or an authorized representative, ask the clerk of a U.S. district court to issue a subpoena to a service provider for identification of an alleged infringer. The request must include a qualifying copyright notice, a proposed subpoena, and a sworn declaration that the purpose is to obtain the alleged infringer’s identity and that any information will be used only to protect rights under Title 17. The statute says the subpoena may order the provider to disclose information sufficient to identify the alleged infringer, to the extent that information is available to that provider.

Take-Two’s August 28 request tracks those statutory elements. It says the company submitted a notification under Section 512(c)(3)(A), a proposed subpoena and proposed order, and a sworn declaration that the information is being sought to identify alleged infringers and protect Take-Two’s rights. The filing asks the clerk to issue and sign the proposed subpoena expeditiously under Section 512(h)(4). The court document does not identify a defendant, allege a completed civil claim against a named person, or set out a damages demand. It is an ex parte identification request involving a third-party service provider.

For players, that is the legal point most likely to be lost amid headline language about a “hunt.” A subpoena request is serious, and the data involved in modern online accounts can be sensitive. But a request is not proof of a person’s responsibility. Take-Two’s filings consistently use the language of alleged infringement. The company still needs to obtain information, analyze it, determine whether it identifies a relevant person or persons, and decide what action, if any, to take next. Discord may also assess the request’s validity and scope, while affected users may have legal avenues to object or seek to quash a subpoena in appropriate circumstances. TorrentFreak noted that service providers can resist demands they view as overbroad and that targeted users can challenge them.

There is another constraint worth emphasizing. Section 512(h) is not a general-purpose permission slip to obtain every kind of information about everyone who encountered allegedly infringing material. The statutory text is focused on information sufficient to identify an alleged infringer of material described in the underlying notice. The Copyright Office explains that a service provider receiving a qualifying subpoena must expeditiously disclose the identifying information required by it. The application of that rule to any broad request is fact-specific and can be contested; no public ruling in this matter has yet established that Take-Two’s original wider Discord request was proper in every respect.

The related Microsoft, X and YouTube efforts

Discord is not the only platform caught up in Take-Two’s response to the August leaks. Reporting on the first wave of filings said Take-Two sought records from Microsoft and Discord, including information tied to accounts and servers that it believed were connected to the unauthorized material. Forbes reported that the Microsoft demand cited a GitHub page where leaked material had been posted and sought records including account IDs, registration emails, IP addresses, phone numbers, linked accounts, and OneDrive content related to Grand Theft Auto. These are reported descriptions of the requests, not evidence that Microsoft has disclosed the data or that a given account belongs to the original source of the material.

Take-Two then filed separate DMCA subpoena applications directed at X Corp. and Google. TorrentFreak reported that the X application listed three usernames and sought records such as account IDs, registration email addresses, IP logs, phone numbers, linked accounts and associated device identifiers. The outlet also reported that some accounts in the X filing appeared to be impostors, while the court record did not publicly explain whether Take-Two regarded them as leak sources or people who had copied the material. That uncertainty is a reminder that online handles are not identities and that a watermark, a repost, or an account name does not by itself prove authorship or access to a development build.

The YouTube track has already changed course. Take-Two’s Google request concerned a particular YouTube video and three online personas: CyberLeeks, Surfer24k and CyberLeek_ar_io. On August 24, Judge John P. Cronan asked Take-Two to supplement its application with information explaining how it had identified those personas and why it believed they were associated with the video. Four days later, Take-Two withdrew the request. Its letter said its investigation was evolving rapidly and that it no longer needed the particular information sought, while reserving the possibility of submitting a new request later if necessary.

The withdrawal should not be misread as a finding that the video was authorized, a judgment clearing any account, or the end of Take-Two’s investigation. It means only that the company told the court it no longer needed that particular Google information at that moment. VGC separately reported that the company’s evolving investigation was the reason it withdrew the YouTube request. Taken together with the second Discord application, the public pattern is one of adjustment: some possible trails have been abandoned, while a more confidential Discord request has been added.

Why GTA VI makes this leak campaign especially consequential

The current dispute arrives unusually close to the announced launch of Grand Theft Auto VI. Rockstar Games says the game is scheduled to release on Thursday, November 19, 2026, for PlayStation 5 and Xbox Series X|S. Rockstar’s official description places Jason and Lucia in the state of Leonida and modern-day Vice City, while Take-Two’s August 2026 earnings release also lists the same date and console platforms. No PC version appears in the platform list in those official materials. For an entertainment release of this profile, unauthorized footage can become not simply a copyright issue but also a challenge to the timing, context and control of official marketing.

Rockstar has already experienced a defining GTA VI breach. In September 2022, the company confirmed that an unauthorized third party had illegally accessed and downloaded confidential information from its systems, including early development footage for the next Grand Theft Auto. Rockstar said at the time that it was extremely disappointed by the manner in which players first saw the game, while also stating that it did not anticipate disruption to its live game services or long-term effects on development. That episode made clear why incomplete footage can be damaging even when it does not derail a project: work-in-progress material is often interpreted by the public as a finished product despite lacking final presentation, performance work, balancing and context.

The 2026 incident is a different legal situation on the public record. The August filings concern alleged online copyright infringement and requests to identify people connected to the distribution of material, rather than a public allegation that a named defendant carried out a network intrusion. Take-Two’s second Discord filing describes audiovisual content, artwork, images, dialogue and other creative elements as copyrighted material. It does not, in the public pages, disclose a complete inventory of what was obtained, who originally accessed it, or whether the company has determined how the material left a controlled environment. Those omissions are not evidence of any particular theory; they are simply limits of what is publicly verified.

Leaks, spoilers and the player experience

For players who want to arrive at launch with as little prior knowledge as possible, the practical consequence is straightforward: unofficial clips, reposts, account names and claims about story content should not be treated as reliable guides to the final game. Unauthorized footage can be cropped, mislabeled, old, edited, stripped of context or paired with unsupported claims. It can also reveal plot, locations or mission material that Rockstar has not chosen to present. The most dependable route for avoiding both misinformation and spoilers is to rely on Rockstar’s official site, trailers and announcements, rather than searching for the leaked material or amplifying it through community spaces.

For players who are following the court story rather than the leaked footage, it is equally important to avoid turning ordinary community members into suspects. The second subpoena filing says Take-Two has identified one additional Discord user and gathered further information concerning a previously identified user. It does not publicly name either person. It does not identify every community member as an alleged infringer. It does not authorize doxxing, harassment, amateur tracing of users, or the publication of personal information. A legal process designed to establish identity is not an invitation for fans to conduct their own investigation.

The privacy dimension is not abstract. Early reporting about the first Discord request described requests for identifying data associated with large groups of users, which prompted concern about scope. Discord’s public response did not promise compliance or resistance; it said the platform had not yet been served at that point and would assess validity and scope if it was served. The new sealed filing may be narrower, but the public cannot independently confirm the exact balance because the document request attachment is not available. That is why the responsible conclusion is limited: Take-Two is now pursuing a more targeted, partly confidential Discord request, while the exact information sought remains undisclosed.

What happens next

As of September 1, 2026, the next immediate procedural questions are whether the court permits the subpoena attachment to remain sealed, whether the clerk issues the second subpoena, and how Discord responds if it is served. The court had not yet issued the second subpoena as of the August 31 report by TorrentFreak. Take-Two’s first-request service statement and Discord’s August 24 statement remain publicly inconsistent, so it is also premature to make claims about what information Discord has supplied in relation to the earlier request.

There may eventually be more filings, a challenge to the scope of a subpoena, a voluntary resolution, a civil case against identified individuals, or no publicly visible next step for some time. None of those outcomes is confirmed today. The only solid conclusion from the new record is narrower but significant: Take-Two has not abandoned its leak investigation. It has filed a second request to Discord, says it has developed additional leads, and wants the details of those targeted demands withheld from the public to prevent alleged infringers from learning what the company knows.

For GTA VI, the story sits at the intersection of copyright enforcement, platform privacy, fan culture and the extraordinary scrutiny surrounding Rockstar’s next release. The legal process will determine whether Take-Two’s requests produce usable identifying information. Until then, the reported “Cyberleek” label is only an online persona associated in reporting and filings with alleged infringement, not a verified real-world identity. Players can follow the case without repeating unconfirmed claims: distinguish a request from an issued subpoena, a subpoena from a production of records, an allegation from a court finding, and a leak from an official representation of the game Rockstar plans to release on November 19, 2026.