Rockstar Games, a subsidiary of Take-Two Interactive Software, has been targeted in a high-profile data extortion attack involving the unauthorized release of gameplay footage from the highly anticipated *Grand Theft Auto VI* (GTA VI). The incident, which saw gameplay videos published online a week before the publisher's planned reveal, has been described by some as one of the most significant data extortion attacks of the year, drawing an unusually large public response due to the game's massive fanbase.
The online persona or group claiming responsibility for the leaks, "CyberLeek," has posted files that suggest direct access to Rockstar Games' sensitive systems or proprietary data obtained from an insider. While the financial and reputational stakes are high for Take-Two, the incident has garnered widespread attention because of the public's intense interest in the game. *Grand Theft Auto V*, the previous installment, has sold over 230 million copies and generated over $11 billion for Take-Two since its 2013 release, with analysts projecting *GTA VI* to achieve between $3.3 billion and $5.2 billion in global sales by the end of its launch week.
Take-Two has responded aggressively through its legal team, filing petitions for subpoenas under the Digital Millennium Copyright Act (DMCA) against Discord, Google, Microsoft, and X (formerly Twitter). These subpoenas seek to identify CyberLeek and other user accounts accused of copyright infringement. Federal judges have granted the subpoenas against Discord, Microsoft, and X, though the petition against Google remained pending. Additionally, Take-Two's legal representatives have issued copyright notices to these platforms regarding the unauthorized material. Following these legal actions, websites associated with CyberLeek that were hosting leaked information and promoting a memecoin have gone offline.
Initially, some observers speculated the leaks might be a marketing stunt, but Take-Two's robust legal response confirms the seriousness of the investigation and the authenticity of the shared content. The company's actions suggest it is treating the breach as an insider threat investigation, indicating that whoever leaked the footage may have had access to an actual build of the game, potentially saving it to a cloud service, uploading it to a file-hosting site, or removing it on an external drive.
CyberLeek has presented conflicting motivations for the leaks. The group claims to be protesting Rockstar's decision against physical game releases, publishing an "anti-corporate manifesto" targeting digital pre-orders and disc-less releases, framing the breach as hacktivism. However, the leaked videos are watermarked with crypto wallet addresses, suggesting a primary objective of financial gain. This combination of political posturing and clear financial monetization, including the launch of a cryptocurrency token and offers to sell ad space on future leaks, represents a novel monetization model for stolen pre-release content. This approach means traditional ransom negotiations or quiet payments may not be effective.
Despite the unique monetization strategy, cybersecurity experts note that the attack's rhythm—steal, publish a sample, promise more, deliver, repeat—is a familiar playbook, akin to ransomware attacks where criminals leverage various pressures, including the threat of future leaks, to profit. The attackers are effectively crowdsourcing pressure, with a significant portion of the player base amplifying the leaks as free content.
Parallels have been drawn to past attacks on major entertainment companies, such as the 2014 Sony Pictures hack and the 2017 HBO breach. While the Sony attack involved data destruction for political motives, the HBO incident, linked to Iranian threat actors, focused on intellectual property theft. This is not Rockstar's first security incident; in 2022, an 18-year-old member of the Lapsus$ cybercriminal gang was sentenced after leaking gameplay footage, an incident that reportedly cost Rockstar, Uber, and Nvidia over $10 million.
Security professionals anticipate an escalation of the situation, as leaks have continued daily for over a week.
