For five days the only visible response to the GTA 6 leak campaign was a wall of takedown notices. That changed this week. Take-Two Interactive, Rockstar's parent company, has gone to a federal court and asked two of the largest platforms on the internet to hand over records that could put a real name on the account calling itself Cyberleek.

According to filings reported by Variety, Kotaku, Tom's Hardware, Windows Central and others, Take-Two submitted subpoena requests to the Southern District of New York on August 20, 2026. Two companies received them: Microsoft and Discord. Both are reported to have until September 4 to respond.

This is the first public legal move of the campaign, and it tells you more about what Rockstar does not know than about what it does.

What the Subpoenas Reportedly Ask For

The two requests are aimed at different halves of the same problem.

The Microsoft subpoena, per coverage of the filing, seeks internal business and investigative records connected to Microsoft's own look into the Cyberleek persona. That reportedly includes anything tied to GitHub, OneDrive or linked Xbox accounts. GitHub and OneDrive both belong to Microsoft, which is why one subpoena can cover code hosting, cloud file storage and a gaming account in a single sweep. Tom's Hardware reported the request extends to Windows device identifiers associated with the accounts in question.

The Discord subpoena is broader in one specific way. Rather than naming a single account, it reportedly asks for identifying information on every account that was a member of the Discord servers involved in spreading the material, covering a window that runs from June 1, 2026 to the present. Three servers have been named in coverage of the filing.

That scope is worth sitting with. A subpoena aimed at one username asks a narrow question. A subpoena aimed at an entire membership list asks a different one: it treats the distribution network itself as the thing to be mapped.

Why a Subpoena and Not a Lawsuit

The instinct is to read this as "Take-Two is suing someone." It is not, at least not yet.

What has been filed is best understood as a discovery instrument, of the type the DMCA makes available to a copyright owner who does not know who the infringer is. As we covered in our explainer on how DMCA takedowns actually work, a takedown notice is a form sent to a platform, not a court order, and it can only make a video disappear. It cannot tell you who uploaded it. A subpoena is the step that converts an anonymous handle into subscriber records, IP logs and device identifiers.

Only after that does a conventional lawsuit become possible, because you cannot sue a pseudonym in any useful way. In other words, this filing is the beginning of a legal process, not the conclusion of one.

The Quiet Authentication

One detail from the filings has travelled further than the rest. The paperwork reportedly describes the leaked material as copyrighted work belonging to the company.

Several outlets have read that as an implicit acknowledgement that the footage is real. It is a reasonable reading: you do not spend legal capital chasing the distributors of material you consider fabricated. It also matches the pattern we noted when the takedowns began, since a DMCA notice is itself a claim of ownership over the exact file being removed.

It is still not a public statement about the leaks. Rockstar has said nothing on the record about the contents of any clip, and has made no public announcement of any kind since August 6, 2026, when it revealed the Extended Look. Its position remains the same as it was in 2022: act through lawyers, never confirm a frame.

What This Does Not Mean

A few guardrails, because the reaction to the filings ran hot.

A Familiar Playbook

There is precedent here, and it is recent enough to be instructive. The September 2022 breach produced roughly ninety clips of early GTA 6 footage, an arrest, and eventually a conviction in the UK. That process was slow, and the public only learned the details long after the internet had moved on. Our 2022 leak retrospective covers how little the leaked footage ultimately told anyone about the finished game.

The lesson from that episode is that legal outcomes and news cycles run on completely different clocks. The clips spread in hours. The case took years.

Frequently Asked Questions

Does this mean Take-Two knows who Cyberleek is?

No. The opposite, if anything. Companies file requests like this precisely because they cannot identify someone through their own records, and reporting this week indicates Rockstar has not yet determined the source of the breach.

Are ordinary Discord users at risk?

The reported scope covers members of specific servers involved in distributing the material during a defined window. That is a much wider net than one account, and it is exactly the sort of scope that platforms and privacy groups tend to contest. Being in a server is not the same as being accused of anything.

Could this delay the Extended Look or the game?

Nothing suggests it will. Rockstar has kept the August 27 premiere in place throughout the leak campaign and reaffirmed November 19 as the release date. See our release date coverage for the full timeline.

Will we find out what the platforms hand over?

Not necessarily, and probably not soon. Responses to subpoenas are frequently filed under seal or simply never publicised. Expect silence rather than a reveal.

The Bottom Line

Take-Two has escalated from takedowns to the courts, asking Microsoft for investigative and account records and asking Discord for the membership of the servers that carried the leaks. The September 4 response deadline is the next date to watch, though it may pass without anything visible happening in public.

The more telling fact sits underneath the paperwork: five days into the largest GTA leak since 2022, the company still does not appear to know who it is chasing. Meanwhile, the thing Rockstar actually wants you to look at arrives on August 27.