Introduction: Gaming's Most Stunning Leak
On a weekend in September 2022, the global gaming community was sent into a frenzy. More than 90 early-development videos and screenshots of Grand Theft Auto VI were anonymously posted on GTAForums. The footage showed an unfinished build of the game—Vice City's neon-drenched streets, the two protagonists, weapon systems, and NPC behavior patterns. For a game that hadn't even been officially announced as in development, it was a disaster.
Rockstar Games was forced to confirm the leak's authenticity, calling it "extremely disappointing." The company stated: "We recently suffered a network intrusion in which an unauthorized third party illegally accessed and downloaded confidential information from our systems, including early development footage for the next Grand Theft Auto."
The leak was widely considered one of the largest and most consequential data breaches in video game history. But what shocked the world even more was the identity of the mastermind behind this cyberattack—a 17-year-old British teenager.
Four years later, the GTA leak story is far from over. From the 2022 GTA 6 video leak, to the public release of GTA 5's source code in late 2023, to the new wave of leaks in August 2026 from a group called CyberLeek, this ongoing cybersecurity crisis continues to sound alarms across the gaming industry.
Chapter 1: September 2022 – 90 Videos and a 17-Year-Old
The Leak Itself
Around September 18, 2022, a user calling themselves "teapotuberhacker" posted dozens of GTA 6 development videos on GTAForums. The roughly 50 minutes of footage came from an early development build, with many elements incomplete and viewable only through debug menus.
The hacker didn't just leak videos—they also claimed to possess the source code for both GTA 5 and GTA 6 and threatened to release more sensitive information unless Rockstar contacted them via Telegram.
The Arrest and Charges
On September 22, 2022, the UK's National Crime Unit (NCCU) arrested a 17-year-old in Oxfordshire. The arrest resulted from a joint investigation involving the London Metropolitan Police, the UK's NCCU, and the FBI.
The teenager was subsequently charged with two counts of computer misuse and two counts of breaching bail conditions. Appearing at Highbury Corner Youth Court, he pleaded not guilty to the computer misuse charges. Prosecutors told the court the suspect had used a mobile device to breach companies and "blackmail them" for illegally obtained software.
Investigations revealed the teenager was not only behind the GTA 6 leak but also involved in a concurrent cyberattack on Uber. Uber stated: "We believe this attacker is affiliated with a hacking group called Lapsus$."
The Attack Method: Astonishingly Simple
As the investigation deepened, the hacker's methods emerged—and their simplicity was breathtaking.
Arion Kurtaj (the arrested teenager) was already on bail at the time, having previously hacked Nvidia. He was under supervision at a Travelodge hotel, with his laptop confiscated by police. Yet with nothing more than an Amazon Fire TV Stick, the hotel television, and a mobile phone he later acquired, he managed to breach Rockstar Games' internal Slack system.
According to content creator Mors Mutual, citing internal Rockstar sources, Kurtaj used a textbook email phishing attack to pull off the intrusion. Once inside Rockstar's internal systems, he even openly identified himself as the "attacker" on Slack.
Rockstar later told the court the incident cost the company approximately $5 million in damages and thousands of hours of lost work.
Chapter 2: Lapsus$ – The Teenage Cybercrime Syndicate
Who Is Lapsus$?
Kurtaj was not acting alone. He was a core member of the notorious international hacking group Lapsus$ (also tracked as DEV-0537)—a cybercrime syndicate composed predominantly of teenagers. Since late 2021, the group had been linked to a string of high-profile attacks, including:
- Microsoft
- Nvidia
- Samsung
- Ubisoft
- Okta
- Uber
- Revolut
- BT Group and its mobile arm EE
Lapsus$ was known for social engineering, SIM-swapping, and exploiting authentication vulnerabilities. The group claimed its primary motivation was money, stating it was "neither political nor sponsored by anyone."
The Hallmarks of Teenage Cybercrime
What made Lapsus$ most alarming was the age of its members. In March 2022, Bloomberg reported that a 16-year-old was behind several of the group's major attacks. Earlier that spring, London police had arrested and released seven teenagers linked to Lapsus$.
These young hackers demonstrated technical sophistication and social engineering skills that unsettled cybersecurity experts worldwide. They exploited not complex technical vulnerabilities but human weaknesses—gullibility, negligence, and lapses in security awareness.
Chapter 3: Arion Kurtaj – From Teen Hacker to Indefinite Detention
Identity Revealed
As the case progressed, the 17-year-old hacker was identified as Arion Kurtaj from Oxfordshire. He was described as the "mastermind" of the Lapsus$ cybercrime group.
Kurtaj already had a prior record of hacking. He had previously been arrested for breaching Microsoft and Nvidia. Investigations also revealed that he and another 17-year-old had been charged with attacking BT Group and EE between July and November 2021, demanding a $4 million ransom.
Psychiatric Evaluation and Indefinite Detention
In July 2023, UK mental health experts assessed Kurtaj and determined that due to "severe autism" and other factors, he was unfit for a traditional criminal trial. As a result, the jury in related proceedings could only determine whether he had committed the alleged acts, not render a direct guilty or not guilty verdict.
In December 2023, a UK court—based on mental health assessments—ordered Kurtaj to be detained indefinitely in a secure psychiatric facility, with no end to the measure unless doctors determined he no longer posed a risk. Assessment reports indicated Kurtaj still expressed a desire to return to cybercrime as soon as possible, and evaluators found he remained highly motivated to reoffend. The judge ruled that Kurtaj still posed a "high risk" to the public, given his continued capability and desire to engage in cyberattacks.
2026 Developments
In July 2026, the situation shifted dramatically. Kurtaj was transferred from the secure hospital to a regular prison, awaiting a retrial scheduled for November 2026. BBC cyber correspondent Joe Tidy confirmed the development on social media.
The transfer suggested authorities now believe Kurtaj may be fit to face criminal proceedings. However, strict reporting restrictions had prevented media coverage until the High Court lifted them on July 14, 2026.
In a bitterly ironic twist, Kurtaj's retrial is set for November 2026—the same month GTA 6 is scheduled for release on November 19.
Provocation from Behind Bars
Even in custody, Kurtaj continued to make headlines. In March 2026, reports surfaced that Kurtaj had smuggled a mobile phone into the secure hospital. He posted selfies from his cell on Snapchat and hinted that GTA 6's source code was "definitely out there somewhere."
According to leaked chat logs, an individual named Omar claimed multiple people possessed GTA 6 source code but were deliberately holding back. Omar added: "They've kept this material sealed for 3.5 years. That's exactly why Rockstar keeps delaying, and exactly why they're worried."
GTA news outlet videotechuk_ noted multiple inconsistencies in Kurtaj's claims—he may have been exaggerating to provoke panic among players, or the source code might indeed be circulating in some hidden corner of the internet. Either way, the fact that Kurtaj could still rattle global gamers from a secure facility underscored the severity of the problem.
Chapter 4: The GTA 5 Source Code Leak – The Aftermath
The Christmas Eve 2023 Leak
The 2022 GTA 6 video leak was only the beginning. On Christmas Eve 2023, GTA 5's complete source code was publicly leaked. Download links spread widely via Discord, dark web sites, and Telegram channels.
In one Telegram GTA leak channel, the channel owner "Phil" posted a download link to the stolen source code along with a screenshot of the folder. More significantly, Phil's post paid tribute to Lapsus$ hacker Arion Kurtaj: " FreeArionKurtaj. He started it all and ensured the leaks reached the public. I have immense respect for him."
Security research group vx-underground said they had spoken with the leaker on Discord. The leaker claimed they had received the source code as early as August 2023 and that their motivation for leaking it was to "combat scams in the GTA V modding community"—many people had been defrauded by others claiming to possess GTA V source code.
The Value and Risks of Source Code
Reports indicated hackers had not only stolen GTA 6 source code but also GTA 5's source code, which they did not immediately release publicly. Instead, they reportedly sold it privately to parties who could profit from it, with asking prices as high as $50,000.
The leaked source code—approximately 100 GB of data—included not only GTA 5's complete code but also GTA 6's Python code and files for the canceled sequel Bully 2 .
The source code leak had far more severe implications than the video leak. Publicly available source code meant:
- Modders could modify the game more deeply
- Cheat developers could more easily bypass anti-cheat systems
- Potential security vulnerabilities could be maliciously exploited
- Competitors could glimpse Rockstar's technical implementations
As recently as November 2024, threat actors were still selling what they claimed was GTA V source code on dark web hacker forums, advertising it as the "latest and fully updated version" including anti-cheat systems and internal company tools.
Chapter 5: CyberLeek – The 2026 Wave of Leaks
A New Threat Emerges
Just as the industry began to recover from the Kurtaj and Lapsus$ saga, a new wave of leaks struck in August 2026—this time from an anonymous individual or group calling itself CyberLeek (also stylized as CYBERLEEK).
Beginning around August 18, 2026, CyberLeek began publishing daily GTA 6 gameplay footage—clips showing protagonist Jason, map details, and core mechanics from what appeared to be 2022–2023-era development builds. The first wave included gameplay videos and apparent images of the full GTA 6 map depicting Leonida, the fictional Florida-inspired state where the game takes place.
Evidence of a Playable Build
What distinguished the CyberLeek leaks from the 2022 footage was the evidence that the group appeared to have interactive access to an internal debug build —not just pre-recorded videos.
One video showed a player spelling "LEEK" on an in-game wall with bullet holes. This was not a screen recording; it demonstrated someone actually running the game and interacting with a development build. Security researchers noted that while this didn't necessarily mean CyberLeek possessed the full retail-equivalent game, it strongly suggested access to a playable developer build, albeit an older version.
The Manifesto and Demands
CyberLeek accompanied their leaks with a manifesto-style set of "commandments" and demands aimed at Rockstar Games and Take-Two Interactive. Their stated grievances included:
- No physical disc for GTA 6 – Rockstar had announced that physical "premium editions" would ship with download codes rather than actual discs. CyberLeek condemned this as anti-consumer, arguing that digital pre-orders offered no benefit to customers since digital products cannot sell out.
- No paywalled single-player DLC – The group demanded that solo player content not be locked behind additional payments.
- Full offline access – They demanded the game remain playable offline without always-online requirements.
- An end to "unfinished games sold as living services" – CyberLeek wrote on its website: "Publishers sell licenses and call them purchases. They ship unfinished games and call them living services. They lock content on discs and call it DLC. They kill games and keep the money. Every year anti-consumerism tightens its grip, and every year gamers get less for what they pay."
CyberLeek claimed their leaks were an act of protest against what they described as Rockstar and Take-Two's anti-consumer practices.
The Cryptocurrency Connection
Complicating the group's "activist" narrative was their simultaneous promotion of a memecoin called $CYBERLEEK. The group set up a website, liquidity pool, and voting program where users could vote on which gameplay clips to release next by sending cryptocurrency tokens.
Reports suggested CyberLeek may have collected what could amount to millions of dollars in crypto during the saga. As one observer noted: "Ideology and a crypto wallet make uncomfortable bedfellows—the 'for the gamers' positioning gets complicated fast when that much money is involved."
The "Dead Man's Switch" – Fact or Fiction?
Perhaps the most dramatic claim to emerge from the CyberLeek saga was the alleged "dead man's switch"—a mechanism that would automatically release the full GTA 6 build to millions of players if the group failed to manually cancel it each day.
The story spread rapidly across gaming media. However, it was later debunked. Insider Gaming, the outlet that initially reported the dead man's switch claim, retracted the story entirely. The "dead man's switch" manifesto was manufactured by copycats imitating the group, not authenticated CyberLeek communication. No verified evidence existed that CyberLeek had issued that specific ultimatum or that any automatic release mechanism existed.
The Hunt for CyberLeek
Take-Two Interactive moved quickly. On August 20, 2026, the company filed multiple DMCA subpoenas in federal district court targeting Microsoft, Discord, X (formerly Twitter), and Google. The subpoenas sought identifying information associated with online profiles and activity linked to the leaks, including Windows device IDs, IP addresses, phone numbers, associated Google and Xbox accounts, and OneDrive content.
The company specifically requested information about the "CyberLeek" account and records related to Microsoft's internal investigation into the leaker's identity. A New York Southern District Court approved the Microsoft subpoena on August 21.
Xbox CTO Scott Van Vliet tweeted: "We are working closely with Take-Two and Rockstar Games to support efforts to protect creative works and intellectual property." Discord stated: "Discord occasionally receives subpoenas related to the Digital Millennium Copyright Act (DMCA). We review and cooperate with valid subpoenas when we receive them, which is standard and routine for a company like ours."
By August 22, CyberLeek's website and Telegram channel had been taken down. The Telegram channel displayed the message: "This channel is unavailable due to copyright infringement."
The Suspect
Online investigators made progress in identifying the culprit. A Discord user named "stayonthegrindd" emerged as the prime suspect.
The timeline was compelling: On August 16, CyberLeek first shared what was believed to be a preview of the GTA 6 map. On August 17, CyberLeek uploaded the now-famous basketball gameplay clip to the dark web. On August 18, at approximately 8 AM, stayonthegrindd entered a GTA 6 Discord server and posted—then deleted—the same basketball video, claiming the footage was from 2026 and asking the community what they wanted to see leaked next. When someone replied "driving footage," he responded: "I'll bring back driving gameplay."
About 90 minutes later, the leaked map was uploaded to the blockchain. Two hours after that, CyberLeek uploaded the first Jason driving clip to the blockchain.
While it remained possible that stayonthegrindd had simply found the basketball video on the dark web and reposted it, the subsequent timeline strongly suggested a direct connection to CyberLeek. As one investigator noted: "This person either held these materials themselves and deliberately chose to release them through channels that would go viral, or they are a friend of the leaker who had access to the content before it was uploaded to the blockchain."
The Origin of the Leak
Reports emerged suggesting the breach may have originated from Rockstar's India office. According to sources, a Russian hacker group—possibly 808 Mafia—first infiltrated a Rockstar India technical director's account through a phishing attack, then used that compromised account to penetrate and bypass internal security defenses, obtaining a GTA 6 Xbox development kit build.
The stolen development build was reportedly sold to CyberLeek for approximately $50 million.
Impact and Industry Response
The CyberLeek leaks came at a particularly sensitive time—just days before a planned Netflix exclusive extended look at GTA 6, scheduled for August 27, 2026. The leaks reportedly caused significant frustration and anger inside Rockstar, though the Netflix reveal plan remained unchanged.
Take-Two's stock slid as investors fretted over the breach. However, industry analysts and USC experts suggested that even a playable leak was unlikely to dent the franchise's record-shattering sales.
Chapter 6: Who Is Really Responsible?
Direct Responsibility: Kurtaj, Lapsus$, and CyberLeek
The most direct responsibility lies with Arion Kurtaj and the Lapsus$ organization for the 2022 leaks, and with CyberLeek for the 2026 wave. Kurtaj was the direct perpetrator of the 2022 GTA 6 video breach, using astonishingly simple means—a phone, a Fire TV Stick, and a hotel TV—to breach one of the world's premier game developers.
Lapsus$, as an organization, provided its members with technical frameworks, attack tools, and psychological support that amplified each member's capabilities and encouraged them to go further down the criminal path.
CyberLeek, whether an individual or a group, demonstrated a more sophisticated operation—involving a development build, cryptocurrency schemes, and a sustained daily leaking campaign that continued even after legal action was initiated.
Indirect Responsibility: Security Gaps and Industry Negligence
However, pinning all responsibility on a teenager or an anonymous hacker group is overly simplistic. Rockstar Games' own security systems had clear vulnerabilities.
A minor, using basic equipment, was able to breach the company's internal Slack system—exposing deficiencies in:
- Multi-factor authentication – If Slack accounts had robust MFA enabled, a password alone might not have sufficed
- Internal permission management – The hacker could openly identify themselves as the "attacker" on Slack, suggesting monitoring and access controls were seriously flawed
- Employee security training – The success of the phishing attack indicated employees clicked malicious links or leaked credentials
Kurtaj was no technical genius—he used textbook phishing. What made him successful was the target company's lax security posture.
Broader Industry Problems
The GTA leaks are not isolated incidents. In December 2023, around the same time as the GTA 5 source code leak, the gaming industry suffered multiple security incidents: Sony's Insomniac Games was hit by a ransomware attack that leaked the in-development Wolverine game; Ubisoft was also attacked, targeting Rainbow Six: Siege internal data.
These events suggest the gaming industry as a whole has systemic cybersecurity weaknesses. Game companies tend to focus resources and attention on product development while neglecting security infrastructure.
Legal and Social Responsibility
Kurtaj's case also raises difficult questions about juvenile crime, mental health, and the justice system. He was deemed unfit for trial due to severe autism, yet assessed as posing a "high risk" to the public. He "continued to express the intention to return to cybercrime as soon as possible" even while detained.
This poses a thorny question: When a minor with severe mental health issues demonstrates sophisticated cybercriminal capabilities, how should society respond? Neither simple incarceration nor medical placement seems to address the root problem.
Chapter 7: Impact and Consequences
On Rockstar Games
The GTA leaks inflicted multiple layers of damage on Rockstar Games:
Financial losses – Rockstar told the court the incident caused approximately $5 million in direct economic damages and thousands of hours of lost work.
Development disruption – The leaks forced Rockstar to prematurely confirm GTA 6 was in development, disrupting marketing plans. Some analysts suggested the leaks may have contributed to Rockstar's decision to reveal the game earlier than planned in late 2023.
Erosion of trust – The breach of internal systems undermined employee confidence in the company's security and potentially shook partner confidence.
Intellectual property risk – The source code leak exposed Rockstar's core technical assets to public view, potentially enabling analysis by competitors and exploitation by cheat developers.
On Players
For players eagerly awaiting GTA 6, the leaks were a double-edged sword. On one hand, they satisfied curiosity about the legendary sequel. On the other, seeing unfinished development builds may have diminished the surprise of the official release.
More seriously, the source code leak could lead to more severe cheating problems, affecting the future online experience of the game.
A Warning to the Gaming Industry
The GTA leaks serve as a wake-up call for the entire gaming industry. They prove that:
1. Age is no barrier to capability – Teenagers can execute sophisticated cyberattacks
2. Security investment cannot be neglected – Even the biggest companies can be breached due to missing basic security measures
3. Leaks have cascading effects – One breach can lead to years of ongoing leaks (as seen with GTA 5 source code appearing a year later)
4. Legal systems face challenges – When perpetrators are minors with mental health conditions, traditional legal remedies may prove inadequate
Conclusion: A Story That Never Ends
From the shocking weekend of September 2022 to Kurtaj's transfer to regular prison in July 2026, from the Christmas Eve 2023 source code dump to CyberLeek's daily leaks in August 2026—the GTA leak saga has stretched across four years. And it is far from over.
GTA 5's source code is now widely circulating online. GTA 6's source code, according to some, remains in certain hands. Kurtaj, though detained, still has "fans" paying tribute to him in Telegram channels. CyberLeek—or whoever is behind that persona—continues to loom as a threat.
Rockstar Games and Take-Two Interactive are fighting back through legal channels. Reports indicate Take-Two has filed multiple DMCA subpoenas targeting Discord, Microsoft, X, and Google.
But can legal pursuit prevent the next leak? History suggests the answer may be no. As long as game companies continue to prioritize security as an afterthought, as long as the barriers to cybercrime continue to fall, as long as teenage hackers see breaching major corporations as a badge of honor—the GTA leak story will inevitably repeat itself with other games.
Arion Kurtaj brought a multi-billion-dollar gaming empire to its knees with an Amazon Fire TV Stick, a mobile phone, and a hotel television. Not because he was a genius, but because he discovered a simple and brutal truth: even the strongest fortress can fall through a single unlocked door.
For the entire gaming industry, the GTA leaks should be a turning point—a moment to rethink security priorities, re-examine internal protections, and redefine industry standards. Otherwise, the next "teapotuberhacker"—or CyberLeek—is already waiting in the shadows for their next opportunity.