Take-Two Subpoenas Microsoft While GTA 6 Preorders Soar

Take-Two Interactive asked a New York federal clerk on August 20 to force Microsoft and Discord to name the people behind Grand Theft Auto 6 leak clips. The publisher used a Digital Millennium Copyright Act identity subpoena, which does not require a lawsuit first. Microsoft’s demand reaches GitHub, OneDrive, and Xbox-linked accounts, even as GTA 6 is due on Xbox Series X and S on November 19.

A second Discord filing on August 28 says the hunt is rapidly evolving. Microsoft is due to produce records on September 4.

Take-Two Filed for Names in New York

Clips attributed to a persona calling itself CyberLeek began circulating around August 18, days before Rockstar’s planned Netflix preview. Take-Two, Rockstar’s parent, went to the U.S. District Court for the Southern District of New York two days later. Counsel Dale M. Cendali of Kirkland & Ellis asked the clerk to issue separate DMCA subpoenas to Microsoft Corporation and Discord, Inc., each on a $52 filing fee.

The Microsoft miscellaneous case is 1:26-mc-00421. The Discord case is 1:26-mc-422. The papers say the material includes audiovisual content, artwork, images, dialogue, or other creative elements from Grand Theft Auto VI, software Take-Two owns. They also describe the footage as stolen content, which is the closest the company has come to saying the clips are real.

Federal copyright law lets a rights holder ask a clerk for a subpoena to identify an alleged infringer without first suing anyone. The owner files a takedown-style notice, a proposed subpoena, and a sworn declaration that the names will be used only to protect rights under Title 17. If those papers are in order, the clerk is supposed to sign and send the subpoena back for service. Once served, the provider “shall expeditiously disclose” identifying information, “notwithstanding any other provision of law.”

THE COURT CLOCK ON THE LEAK HUNT

1. August 18, 2026: Gameplay clips tied to CyberLeek begin spreading online.
2. August 20, 2026: Take-Two files DMCA subpoena requests on Microsoft and Discord in Manhattan federal court.
3. August 21, 2026: The court grants the first Discord request and the clerk issues it that day. Take-Two also files a request aimed at X Corp.
4. August 24, 2026: Discord’s marketing director says the company has not yet been served and will weigh validity and scope.
5. August 28, 2026: Take-Two files a second Discord request, saying the investigation is rapidly evolving.
6. September 4, 2026: Microsoft is commanded to produce records at 10:00 a.m.

That path is faster than a John Doe copyright suit, and it is why Microsoft and Discord, not CyberLeek, are the parties under a clock. The papers still have to be served, and a provider can still fight over how wide the demand is. Take-Two told the court the first Discord subpoena was promptly served after the August 21 issuance. Discord’s public line, three days later, was that nothing had arrived.

What Microsoft Must Hand Over by Friday

Microsoft is not a bystander platform in this launch. GTA 6 is scheduled for Xbox Series X and S on November 19, 78 days from today. The same company owns GitHub, where Take-Two says a leak repository went up, and OneDrive, where the papers seek stored files that mention GTA, Rockstar, or CyberLeek. The Microsoft subpoena production list also asks for Xbox-linked connections and device identifiers such as MachineGuid and MSA.

Attachment A goes further than a simple GitHub takedown. It demands all internal Microsoft business records and investigative records associated with Microsoft’s internal investigation of the “cyberleek” persona, enough to identify the users, persons, or entities behind it. In other words, Take-Two is not only asking what a public repo showed. It wants Microsoft’s own file on the persona, then the consumer-identity stack that can tie a Discord login to an Xbox profile and a cloud folder.

Scott Van Vliet, Xbox’s chief technology officer, put the company’s posture on the record the day after the first filings. He did not mention GitHub, OneDrive, or a production date. He pledged cooperation on intellectual property, which is the stance a launch partner can take without walking through what the subpoena actually lists.

We are working closely with Take-Two and Rockstar Games to support efforts to protect creative works and intellectual property.

— Scott Van Vliet (@scottvanvliet) August 21, 2026

GitHub’s own rules explain why a games publisher would bother with a developer site. Under GitHub DMCA takedown policy, a rights holder can demand that infringing user content come down, and a claim over an entire repository can lead GitHub to disable it. Take-Two’s papers treat one repository as a leak dump that should be shut, not patched. A single copyright claim can carry statutory damages of up to $150,000, which is the pressure sitting behind the safe-harbor process those platforms run every day.

WHERE THE IDENTITY DEMANDS LANDED

The Microsoft return is due at Kirkland & Ellis, in care of a Woodbury, New York process shop, not at an Xbox studio. Friday is the first hard production date on the public docket. Whether those records name a person, or only a trail of linked logins, is still untested.

Discord’s Named Servers Pull In Bystanders

The Discord papers do not stop at the uploader. Take-Two asked for all identifying information associated with all user accounts that are or were members communicating on listed servers from June 1, 2026 to the present. For those accounts it wants registration email, registration and last-login IP addresses, phone number, linked Google or Xbox connections, device identifiers, and OneDrive content related to GTA, Rockstar, or CyberLeek. That is a membership roster plus a forensic filter, not a one-handle lookup.

The louder problem is the width of that net. Named servers include Ødyssey.gg, a public Odyssey guild, and the DarkViperAU editors’ server at discord.gg/darkviperau. DarkViperAU is a GTA video creator. Being named as a venue is not the same as being accused of the leak, and the papers do not charge him with posting the clips. Anyone who joined those rooms after June 1 still sits inside the ask.

SERVERS AND HANDLES IN THE FIRST DISCORD DEMAND

• CYBERLEEK: Listed as a user account tied to the leak persona.
• CINEMATICROCKSTAR: A second handle named in the petition.
• Surfer24k: Named with replacement handles cyberleek_west and surwest.
• Ødyssey.gg and ! Odyssey: Community servers Take-Two says carried the infringing traffic.
• DarkViperAU editors’ server: A creator-side room named as a communication venue, not as the source of the build.

Ryan K. Rigney, Discord’s marketing director, answered the privacy fight in public on August 24. He did not promise a dump of every member file. He said the company had not yet been served and would evaluate validity and scope before responding, which is a narrower stance than Xbox’s same-week pledge.

I can share an update on this:

Discord has not yet been served with a subpoena from Take Two.

When we do, we'll evaluate the validity and scope before responding. https://t.co/FshT3VlUCy

— Ryan K. Rigney (@RKRigney) August 24, 2026

A leak-watch crowd treated that gap as the whole story, either begging the internet to protect the leaker or calling the server list a mass trawl of people who only watched clips. The filing’s own words support the second complaint more than the first. Take-Two asked for every member on named servers, then for extra device data where leak-file artefacts showed up. That second filter may shrink the pile. It does not change the first ask, which starts with the full roster.

The Sealed Request for Two Discord Users

On August 28, the day after Netflix’s extended look, Cendali went back to the Discord docket. The new request is Take-Two’s second DMCA subpoena to Discord. The company told the clerk it had identified one additional Discord user and obtained more identifying information for a person already named, plus more targeted facts on the community servers from the first subpoena. Those extra accounts “are believed to be involved in the same infringing activity,” the filing says.

Take-Two also asked to keep the new names off the public docket. Public disclosure, it told the court, could compromise the investigation and even tip off alleged infringers, creating a substantial risk they would delete, destroy, or hide evidence, or take further steps to evade identification. That is a shift from the first wave, which printed handles and invite links in open exhibits.

WHAT WE KNOW

• Second request date: Take-Two filed the follow-up Discord papers on August 28 and said the first subpoena was issued August 21 and promptly served.
• Narrower target: The new ask focuses on one additional user and more detail on a previously identified user, not a fresh list of public servers.
• YouTube drop: After a judge wanted a tighter link between three channels and one video, Take-Two withdrew the Google request and said it no longer needed that information.

WHAT IS UNCONFIRMED

• Service on Discord: Take-Two’s August 28 filing and Rigney’s August 24 post still disagree on whether the first subpoena had been served.
• The two users: The extra Discord identities are not in the public August 28 clerk request, and a seal request would keep them that way if granted.
• Friday’s Microsoft file: There is no public confirmation yet that GitHub, OneDrive, or Xbox records will land on September 4 as commanded.

CyberLeek kept posting after the first subpoenas, including a clip in which the player shoots the word LEEK into a wall, a flourish that only works if someone is inside a playable build rather than splicing old trailers. Impersonator accounts showed up on X, Discord, and Telegram, and the persona said it operated a Telegram channel and a website that was later taken down. Full-PC-build dump threats that spread in the same week were later called fabricated. The legal hunt and the clip drip ran on parallel clocks, and only one of those clocks has a date certain this week.

The 2022 Breach Still Shapes This Hunt

Rockstar has already lived through a GTA 6 leak that dwarfed a week of Discord clips. In September 2022, Arion Kurtaj, a member of the Lapsus$ group, pulled 90 in-development videos from the studio and dumped them on a fan forum more than a year before the first trailer. He posted in Rockstar’s Slack as an attacker and threatened to release source code unless the company contacted him on Telegram. Rockstar told a British court the recovery cost $5 million plus thousands of hours of staff time.

Kurtaj was 18, autistic, and found unfit to stand a standard criminal trial. A jury was asked only whether he had done the acts. It found he had, across 12 counts that included computer misuse, blackmail, and fraud. In December 2023 a judge imposed an indefinite hospital order. By July 2026 he had been moved out of that hospital and into prison to await a retrial scheduled for November, the same month GTA 6 is due on consoles. Nothing in the new New York papers names him as CyberLeek. The 2022 case is the scar this legal team is working around: a teenager with a Fire stick and a hotel television already proved the build could walk out the door.

This year’s leak looks less like a Slack raid and more like a distribution problem. The clips show Jason Duval driving, stealing cars, flying a plane, and moving through Vice City and the state of Leonida. Lucia Caminos appears. Someone had a build recent enough that a 2025 radio song shows up, and interactive enough that a wall can be tagged on command. Take-Two’s answer this time is not a British computer-misuse prosecution after the fact. It is a U.S. identity subpoena aimed at the platforms that stored and spread the files, while the game is still unreleased.

Preorders Held Up Through the Leak Week

The leak wave did not land on a cold campaign. Preorders opened June 25, and Take-Two’s quarter ended June 30. On an August 7 earnings call, before CyberLeek’s August clips, CEO Strauss Zelnick already refused to give a unit count and still reached for the strongest language on the call.

I’m not gonna tell you how many units we’ve sold, or we’re selling, but I’d say that the sales are unprecedented and astonishing and astronomical, and that we don’t know how to translate that into numbers yet.

Strauss Zelnick, CEO, Take-Two Interactive, on the fiscal first-quarter call

The company’s first quarter fiscal 2027 results put net bookings at $1.39 billion, down 3% from $1.42 billion a year earlier and slightly above guidance. GAAP net revenue was $1.53 billion. The net loss widened to $34.1 million from $11.9 million, and cost of revenue included a $43.4 million write-down on an unannounced third-party game Take-Two stopped. Management still reiterated fiscal 2027 net bookings of $8.0 to $8.2 billion, with the November 19 GTA 6 launch inside that range. The Grand Theft Auto series itself rose 3% in the quarter.

Standard GTA 6 is $79.99. The Ultimate Edition is $99.99. Zelnick has said the business is well over 90% digital, which is why a GitHub folder and a Discord invite now sit closer to the cash register than a pressed disc would have. The franchise has sold 470 million units. GTA V alone is over 230 million. Rockstar is selling a campaign that can run an 80-hour mix of story and optional goals, and it still chose to open the next official look on Netflix rather than on its own channel first.

That extended look ran August 27 at 3 p.m. ET for Netflix subscribers and landed on YouTube and Rockstar’s other channels six hours later, at 9 p.m. ET. Take-Two went back to court on Discord the next day. The marketing calendar and the clerk’s docket moved in the same week, and neither paused for the other.

The November 19 Launch Date Has Not Moved

GTA 6 is still dated for November 19 on PlayStation 5 and Xbox Series X and S. Take-Two has not used the leak week to slide that date, and Zelnick’s bookings outlook still treats the launch as the year’s center of gravity. The legal work between now and then is identity work. Friday’s Microsoft production, if it arrives, is a packet of logs and linked accounts, not a courtroom naming. Discord’s second request, if signed and served, is meant to be quieter than the first.

CyberLeek also tied clip drops to a meme coin and later appeared to cash out of that coin, after which new footage slowed. That sideshow is not in the subpoena captions. The captions are about who uploaded copyrighted Grand Theft Auto VI material to GitHub, Discord, and X, and which Xbox or OneDrive accounts sit behind those logins. Microsoft has to answer that as both the host of the developer platform and the maker of a console that needs this game. Discord has to answer it as the room where the clips were watched. Two days remain on the first of those clocks.