How Take-Two Is Hunting the GTA 6 Leaker Without Suing Anyone

Key takeaways

• Filed 20 August 2026 in the Southern District of New York as 1:26-mc-00421 (Microsoft) and 1:26-mc-00422 (Discord), by Kirkland & Ellis.
• Legal basis is §512(h) of the DMCA — issued by the court clerk, not a judge. No lawsuit required.
• Records are due 4 September 2026, 10am EDT. The orders were approved a day after filing.
• The demands are broad: identifying data for all members of named Discord servers, not just posters, back to 1 June 2026.
• Two appeals courts have limited §512(h) so it cannot reach mere conduit internet providers — but it does reach hosts like Discord and GitHub.
• It only produces what the provider already stored. A disciplined leaker may leave nothing identifying.

The mechanism: a subpoena with no lawsuit attached

Almost every subpoena in American civil practice exists because a case exists. You sue someone, the case is opened, and discovery lets you compel evidence. No case, no subpoena.

Section 512(h) of the Digital Millennium Copyright Act is the exception, and it was written for exactly this situation: a copyright owner who knows their work is being infringed online but has no idea who is doing it, and therefore cannot file the lawsuit that would normally unlock discovery.

The procedure is deliberately mechanical. The copyright owner files three things:

1. A copy of the takedown notice already sent to the service provider;
2. The proposed subpoena itself;
3. A sworn declaration that the purpose is to obtain the identity of an alleged infringer, and that the information will be used only to protect rights under the copyright statute.

If the paperwork is in order, the statute directs the clerk of the court to issue and sign the subpoena expeditiously. Not a judge. There is no hearing, no defendant, and nobody in the room to argue the other side.

That explains the shape of Take-Two's filings. The case numbers contain mc — miscellaneous — rather than cv for a civil action, because there is no civil action. It also explains the speed: applications on 20 August, approval on 21 August. Litigation does not move at that pace; paperwork does.

Take-Two's counsel filed the required declaration confirming the purpose is identifying the alleged infringer and that the information will be used only to protect its rights.

Why these two companies

Microsoft is in the filing because it owns GitHub, where copyrighted GTA 6 material was allegedly posted. The demands go well beyond a takedown log: business and investigative records from Microsoft's own internal investigation of the cyberleek persona sufficient to identify the users, account IDs, registration emails, IP addresses, phone numbers, linked Google and Xbox connections, device identifiers, telemetry showing tool artefacts, and GTA-related OneDrive content.

Discord is in the filing because that is where the material spread. The demand there is for identifying information associated with user accounts that are or were members communicating with several named servers, covering the period from 1 June 2026 onward.

Microsoft has signalled cooperation rather than resistance. Xbox chief technology officer Scott Van Vliet posted that the company is "working closely with Take-Two and Rockstar Games to support efforts to protect creative works and intellectual property."

That is worth noting for what it implies. A provider has no obligation to fight a facially valid 512(h) subpoena, and usually does not. The practical protection for users is not the provider's resistance — it is the statute's own limits.

What the statute cannot do

Two limits matter, and both are routinely missed in coverage.

The conduit limit. In RIAA v. Verizon Internet Services (D.C. Circuit, 2003) and In re Charter Communications (Eighth Circuit, 2005), federal appeals courts held that §512(h) does not apply to a service provider acting as a mere conduit — carrying traffic under §512(a) rather than storing material at users' direction. The recording industry had been using 512(h) to make consumer internet providers hand over subscriber names en masse; the courts shut that down, on the reasoning that a provider who stores nothing has nothing to take down, and the subpoena power is tied to the takedown regime.

The practical consequence is that this power reaches hosts, not pipes. Discord and GitHub store user-submitted material, so they are squarely within range. The internet provider carrying the connection is not.

The records limit. A subpoena compels what a company has. It does not conjure what nobody recorded. If the CyberLeek accounts were created with disposable email addresses, accessed exclusively through a VPN, and never linked to a Google or Xbox identity, the production may arrive full of data that identifies nobody.

This is why the demands are drawn so widely, and why the Microsoft request explicitly reaches for device identifiers and telemetry. Investigators unmasking a persona are rarely looking for one decisive record. They are looking for a correlation: the same device fingerprint appearing under a careful account and a careless one, an IP address that appears once without the VPN, a phone number reused across services. Anonymity fails at the seams, and the seams show up when you can compare several providers' records side by side.

There is also a route back for the affected. A recipient — or a user whose data is sought — can move to quash the subpoena, and providers frequently notify users before producing. That is a real check, but an uneven one: it depends on notice arriving, and on the individual having the means and appetite to litigate against Take-Two.

The breadth problem, made concrete

Here is where the story stops being procedural.

The Discord subpoena does not ask for information about the accounts that posted the leaks. It asks for identifying information about accounts that were members communicating with the named servers. Among those named is the DarkViperAU editors' server — DarkViperAU being a long-running GTA content creator with no alleged connection to the breach whatsoever.

The creator's response was public and immediate: they do not know anything about the leaks; the server named in the filing is not their editors' Discord; and no clips of the leaks were shared in either of their Discords. They allowed that the leaker may have visited one of the servers, but were not certain, and noted that nobody from Rockstar had contacted them.

That is the entire issue in one example. Membership of a Discord server is not evidence of anything. Servers with thousands of members accumulate people who joined once and never returned. A demand framed around membership rather than conduct sweeps up every one of them, and the person whose name ends up in a federal filing learns about it from social media.

The fair version of Take-Two's position is that this is not malice and probably not even unusual. Its lawyers do not know which accounts matter, which is the entire premise of a 512(h) subpoena; they are asking for the haystack because they cannot yet describe the needle. Copyright owners have used these subpoenas broadly for two decades, and the overwhelming majority of the resulting data is never used against anyone.

The fair version of the objection is that a clerk-issued instrument, with no adversarial hearing and no defendant present, can compel the identification of thousands of uninvolved people in a day — and the only person who spoke up here did so because their handle happened to be in the document. Everyone else in those servers has no idea.

Both things are true. This is what the statute was designed to do, and the design has a cost that falls on people with no part in the underlying dispute.

What happens after 4 September

Assume the records arrive. Three paths open.

A civil suit. Once identified, Take-Two can sue for copyright infringement. Statutory damages for wilful infringement run to $150,000 per work in the United States, and this leaker attached a fundraising mechanism to the releases, which is exactly the sort of fact that makes wilfulness easy to plead. Depending on how the build was obtained, claims under the Computer Fraud and Abuse Act and trade-secret statutes may follow.

A criminal referral. Take-Two does not decide this, but civil discovery producing a name and an address makes a referral considerably more attractive to prosecutors. The 2022 GTA 6 breach was ultimately a criminal matter, not a civil one.

Nothing much. If the records identify a VPN exit node and a disposable address, this ends here and the investigation continues by other means. That outcome is entirely possible, and it will be reported as a failure of the subpoena when it is really the ordinary result of decent operational security.

There is a fourth possibility, and it is the one that would matter most: if the leaker is or was inside Rockstar, the platform records may never be the decisive evidence at all. The second group claiming access says it phished an employee in India, and internal access is not a problem you solve with a Discord subpoena. We covered what is known and unknown about both breaches in our piece on the CyberLeek leak.

What is genuinely unknown

Reasonably established: the filing date, court, case numbers, counsel, statutory basis, the categories of records demanded, the 4 September deadline, the approval a day after filing, Microsoft's public statement, and DarkViperAU's public denial.

Not established: whether the records will identify anyone; whether Microsoft or Discord will produce in full, in part, or seek to narrow the requests; whether any affected user will move to quash; and whether Take-Two intends civil litigation, a criminal referral, or simply an internal answer to how a build got out.

Also unknown, and more important than any of it: whether this is a platform problem at all. Everything in these subpoenas concerns distribution — who posted, who received, who was in the room. None of it addresses acquisition. Rockstar tightened its security substantially after 2022, including ending remote work, and a build still left the building. Identifying the account that uploaded the clips would close the case that Take-Two can file. It would not necessarily answer the question Rockstar actually needs answered.

Sources: Kotaku — Take-Two subpoenas Microsoft and Discord; VGC — Take-Two files subpoenas in hunt for GTA 6 leaker; Shacknews — subpoena filings; Insider Gaming — subpoenas name a content creator; Tom's Hardware — scope of the Microsoft request; 17 U.S.C. §512 — Cornell LII; RIAA v. Verizon, 351 F.3d 1229 (D.C. Cir. 2003). Accurate as of 22 August 2026; this is an explanation of public filings, not legal advice.