The Comprehensive Chronology & Breakdown
This archive now has two connected stories: the confirmed September 2022 intrusion and a separate August 2026 wave of alleged internal-material leaks. They should not be merged without evidence. The latest claims below are reported as claims, while first-party announcements remain the highest-confidence record.
August 2026: The Cyberleek Reports
Between August 18 and August 21, reporting from PC Gamer, Tom's Hardware and Axios described accounts using the name Cyberleek or LEEK publishing alleged GTA VI development footage, map-related material and gameplay clips. Some coverage said the material appeared interactive or came from a playable test environment. That is a media observation, not an authentication issued by Rockstar.
Take-Two was reported to have sought DMCA subpoenas directed at Microsoft and Discord to identify the account holder or group. The reported requests concern account, device, IP and service records. They are part of an identification effort, not a public finding that Cyberleek is the 2022 attacker, that a final build was stolen, or that source code was taken.
Rockstar's official GTA VI page continues to list November 19, 2026, and announces an Extended Look for August 27. No official Rockstar or Take-Two statement in the cited record says the August reports changed the launch plan.
The Breach (2022)
In September 2022, Rockstar Games acknowledged that an unauthorized third party had accessed its network and downloaded confidential information, including early-development footage for the next Grand Theft Auto. The clips showed a debug build in active production, which is why individual animations, interfaces or test scenes should not be read as final features.
Public court reporting identified Arion Kurtaj as a Lapsus$ member involved in the attack. The intrusion was associated with social-engineering techniques and access to internal collaboration systems, including Slack and Confluence in widely reported accounts. Around 90 short clips circulated online. We refer to that material only at a high level and do not host, embed or directly link to it.
Corporate filing / incident descriptionThe Aftermath & Legal Trial
The UK proceedings placed the breach inside a broader Lapsus$ case. Evidence described Kurtaj using an Amazon Fire Stick to access systems from a hotel while on bail, an unusual detail that became central to public reporting. The court found him responsible for the Rockstar attack and imposed an indefinite hospital order, reflecting the assessed risk and the court's findings.
A rigorous archive should keep the legal result in its lane: it establishes responsibility for the attack, but it does not turn every online rumor about stolen files into evidence.
The Trailer 1 Early Leak (2023)
Rockstar had announced that the first GTA VI trailer would arrive on December 5, 2023. An unauthorized copy appeared on X shortly before the scheduled premiere. Rockstar responded by publishing the official trailer early, preserving a first-party version and directing audiences toward the legitimate source.
Trailer 1 independently confirmed Lucia, Jason, the Leonida setting and a return to Vice City. Those are official confirmations; they are not proof that every visual detail from the 2022 footage survived development.
Rockstar Newswire / Trailer 1The Impact on Development
Rockstar's initial statement said the intrusion was not expected to disrupt its live services or ongoing projects. Take-Two's corporate disclosures characterize the material as early-development footage. The public record does not support the claim that the breach “completely delayed” the game or exposed a complete source-code repository.
The current official release date is November 19, 2026, revised from the earlier May 26, 2026 target. Neither date has been officially attributed to the 2022 incident.
Rockstar Newswire / current launch dateCyberLeek Gameplay Files: What The Reported Clips Show
This is a text-only editorial description of the material discussed by media and players. No video, image, game build, code or direct mirror is hosted here. Every item below is labeled as reported, analyzed or discussed; none is presented as Rockstar-confirmed content.
Basketball and the reported Focus meter
PC Gamer described a reported basketball sequence in which a successful shot appears alongside a +2% Focus change. Players have read this as a possible activity-to-progression link, similar in spirit to Rockstar's character-state systems. The clip does not prove a final skill tree or a permanent stat system; it is a reported observation from an unverified development build.
MEDIA / COMMUNITY DISCUSSION · UNVERIFIED BY ROCKSTARCollision, stamina and the possible six-star display
A reported road confrontation involving Jason, a delivery vehicle and its driver is said to show a stamina bar during melee combat. Coverage also discusses two active wanted stars with four empty positions, which has led players to speculate that a six-star ceiling may return. This is community and media analysis, not an official feature announcement.
MEDIA / COMMUNITY DISCUSSION · UNVERIFIED BY ROCKSTARKnife combat and voiced story material
Reports describe a knife takedown followed by a voiced cinematic sequence. The combination of combat animation, camera direction and dialogue is one reason commentators believe the files came from an interactive development environment. It cannot establish final mission order, dialogue, character fate or whether the scene remains in the shipping game.
MEDIA / COMMUNITY DISCUSSION · UNVERIFIED BY ROCKSTARAircraft control and the bullet-mark signature
Tom's Hardware described footage in which an aircraft is controlled at low altitude and the player fires bullet marks spelling LEEK on a wall. Commentators use the interaction as evidence that the footage is not simply pre-rendered CG. It still does not prove the existence of a complete retail build.
MEDIA / COMMUNITY DISCUSSION · UNVERIFIED BY ROCKSTARFast driving, weather and a convenience-store robbery
Media and community summaries describe coastal high-speed driving, wet-road reflections and a robbery in which a cash value changes while a register is opened. These details have driven discussion about denser world interactions, but a visible interface or reflection is not proof of the final console performance target.
MEDIA / COMMUNITY DISCUSSION · UNVERIFIED BY ROCKSTARSlow-motion crash presentation
A reported collision sequence appears to use a short slow-motion camera treatment. Players compare it with Rockstar's cinematic crash language and vehicle physics. The footage can support discussion of a tested presentation style, but not a claim that every crash will trigger the same camera.
MEDIA / COMMUNITY DISCUSSION · UNVERIFIED BY ROCKSTARStrip-club escape and the alleged leak pun
Reports place Jason in a strip-club environment after a police escape and describe dialogue that commentators interpreted as a deliberate leak-related joke. Because the uploader selected and edited the material, the line should remain attributed and uncertain rather than treated as a confirmed story beat.
MEDIA / COMMUNITY DISCUSSION · UNVERIFIED BY ROCKSTARFive county names discussed in the reported map
Community mapping projects and specialist sites have discussed a broad Leonida map carrying five labels: Vice-Dale, Leonard, Kelly, Mariana and Lummox. Player analysis generally associates them with the Vice City metropolitan area, coastal and port districts, industrial settlements, wetland regions and northern wilderness.
These names are useful for tracking the August story, but they are not a Rockstar-published administrative map. County boundaries, scale, settlement names and the final playable area remain uncertain.
The “digital-only” manifesto
Reports attribute a manifesto to the CyberLeek identity criticizing digital pre-orders and physical editions that contain a download code rather than a game disc. Other coverage has pointed to memecoin or donation promotion attached to leak posts. These details describe the uploader's public messaging as reported; they do not independently explain the intrusion or prove who obtained the files.
The archive records the alleged motive without endorsing it. A protest message, financial promotion and an underlying cyber incident are separate claims that require separate evidence.
Tom's Hardware reportInteractive Incident Timeline
A descending log of what happened, when it happened, and how confidently it can be stated.
Rockstar schedules an Extended Look
Rockstar's official GTA VI page lists an Extended Look for August 27, 2026, ahead of the November 19 launch. It is an announced first-party event, not a response that has been officially linked to the Cyberleek reports.
Coverage tracks a widening Cyberleek leak
Axios reported that the Cyberleek material had expanded to multiple gameplay clips and map-related assets. The report also described a short-lived market-value swing for Take-Two. These are reported developments, not an official technical postmortem.
Take-Two seeks records from Microsoft and Discord
Tom's Hardware reported two DMCA subpoena efforts aimed at identifying the person or group behind the Cyberleek accounts, including records connected to Microsoft services and Discord communities. The filings do not publicly establish the attacker's identity or prove a source-code theft.
Cyberleek begins publishing alleged internal footage
PC Gamer reported that accounts using the Cyberleek or LEEK name began circulating alleged GTA VI development footage. The origin, authenticity, build date and access path remain unverified by Rockstar or Take-Two. This archive does not host, embed or link to the material.
Trailer 1 goes live after an early leak
Rockstar moved its scheduled release forward after an unauthorized copy appeared on X. The official version was published on December 4, 2023 in the US, with Lucia and Leonida becoming the first confirmed story and setting signals.
Kurtaj receives an indefinite hospital order
A UK court found Arion Kurtaj responsible for the Rockstar attack and other Lapsus$ incidents. The court heard he continued hacking from a hotel with an Amazon Fire Stick while on bail; the order reflected assessed risk rather than a conventional fixed prison term.
Unauthorized access exposes early-development material
Rockstar confirmed a network intrusion and the unlawful access of confidential systems. Around 90 short clips of an early GTA VI build circulated online. We do not host, embed or link to those materials.
Rockstar says development and services remain unaffected
The company stated it did not expect the incident to affect its live game services or ongoing projects. Take-Two later described the material as early development footage, a distinction that matters when assessing claims about the final game.
Confirmed Facts vs. Fake Rumors
A claim is only promoted to “confirmed” when it is supported by a first-party statement or an official trailer. Unknown is a valid result.
GTA 6 Cyber Leak FAQ
Short answers with the confidence level and source discipline a search result cannot show at a glance.
Rockstar said an unauthorized third party accessed its network and downloaded confidential information, including early-development footage. Public reporting and court evidence later connected the attack to Lapsus$ member Arion Kurtaj. This archive avoids reproducing the stolen material.
Built for verification.
We prioritize Rockstar Newswire, Take-Two filings and court records. Secondary reporting is used for context, never as a substitute for a primary record.