The GTA 6 Hackers: From the Lapsus$ Teen to the CyberLeek Who Leaked the Map

GTA 6 may be the most leaked game in the history of the medium — and by two hackers with opposite profiles. In September 2022, a British teenager from the Lapsus$ group posted 90 videos of an early build, more than a year before the first trailer. In August 2026, three months before launch, someone under the name CyberLeek released clips from a playable build and the full map of Leonida. Rockstar responded very differently each time. This is the whole story.

Quick answer: what leaked and who did it?

2022: Arion Kurtaj, then 17 and a Lapsus$ member, breached Rockstar and posted 90 gameplay videos and source-code snippets on GTAForums — from a hotel room, under police protection, using an Amazon Fire Stick and a phone. He was found unfit to stand trial and, in December 2023, received an indefinite hospital order; in July 2026 he was moved to prison awaiting a retrial in November. 2026: CyberLeek released, between August 18 and 20, at least six clips, a cutscene and the Leonida map, claiming a playable build; Take-Two lost about $2 billion in market value and went to court to subpoena Microsoft and Discord.

2022: the leak that changed Rockstar

On September 18, 2022, a user called “teapotuberhacker” posted 90 videos of an in-development GTA 6 build on GTAForums — Lucia and Jason robbing a diner, debug tools, placeholder graphics. The next day Rockstar confirmed the intrusion and said it was “extremely disappointed,” but insisted development would not be affected.

The Fire Stick hacker

British police identified Arion Kurtaj, 17, already arrested months earlier for Lapsus$ attacks on Nvidia, Microsoft and Uber. The detail that became legend: the Rockstar hack was carried out while he was in police custody at a Travelodge hotel, without a computer — he used an Amazon Fire Stick, the room’s TV and a phone. Doctors found him unfit to stand trial (severe autism); a jury concluded in 2023 that he committed the acts, and in December 2023 the judge ordered indefinite hospital detention, “until he is no longer a danger.” In July 2026, Kurtaj was moved from a secure hospital to prison, awaiting a retrial set for November 2026 — the same month the game launches.

2026: CyberLeek and the Leonida map

Between August 18 and 20, 2026, days before the official showcase, clips attributed to CyberLeek surfaced: Jason drinking beer on a boat, driving segments and, to prove the build was playable, the character spelling “LEEK” on a wall with bullets. Alongside them, the full Leonida map, at a resolution good enough for the community to cross-reference with the trailers. Industry sources described the material as a 2025 build.

Motive: protest or promotion?

CyberLeek claimed the leak was a protest against pre-selling digital copies and other industry practices. Outlets that analyzed the videos noticed something else: the group’s cryptocurrency plastered across every clip. Rockstar and Take-Two never confirmed the material’s authenticity or explained how it left the company.

The stock hit and the legal response

Take-Two lost roughly $2 billion in market value during the week of the leaks. On August 20, the company asked the federal court in the Southern District of New York for subpoenas against Microsoft and Discord under the DMCA: Windows device identifiers, registration and login IPs, phone numbers, linked Google and Xbox accounts and even OneDrive contents for every account that communicated in three Discord servers since June 1, with a September 4 deadline. The breadth of the request drew backlash from fans and privacy advocates — Forbes called the episode a “PR disaster.”

The two leaks, side by side

	2022 — Lapsus$	2026 — CyberLeek
When	September 18, 2022	August 18–20, 2026
What leaked	90 videos + source-code snippets	6+ clips, a cutscene, the full Leonida map
Game stage	Prototype, placeholder graphics	Playable build (reported as 2025)
Author	Arion Kurtaj (identified, convicted)	Anonymous; identity under investigation
Response	Public confirmation; “no impact on development”	No confirmation; subpoenas to Microsoft and Discord
Consequence	Indefinite hospital order; retrial Nov 2026	~$2B in market value; Extended Look a week later

What Rockstar learned (and what it did not)

After 2022, Rockstar tightened internal security and, employees say, restricted remote work. Even so, a playable build got out in 2026 — which points to an internal or partner source rather than a classic external intrusion. This time the response was marketing: seven days after CyberLeek’s clips, the Extended Look on Netflix delivered 27 official minutes in 4K and simply buried the leaks. Against a leak, the best weapon was showing more.

Why this matters to you

For players, the practical lesson is caution: sites promising to “download the leaked GTA 6 build” are malware scams. For anyone in tech, the Kurtaj case shows social engineering (he got in through Rockstar’s Slack) beats firewalls, and the CyberLeek case shows how far a company will go legally to identify a leaker — including data on thousands of innocent users in a Discord server. And if you just want the game: November 19 still stands.

Frequently asked questions

Who leaked GTA 6 in 2022?

Arion Kurtaj, then 17, a member of the Lapsus$ group. He posted 90 videos on GTAForums and was sentenced in December 2023 to an indefinite hospital order; a retrial is scheduled for November 2026.

What is CyberLeek?

The name used by whoever released, between August 18 and 20, 2026, gameplay clips and the full Leonida map, claiming to have a playable GTA 6 build. The identity has not been confirmed.

Did the leaks delay GTA 6?

No. Rockstar and Take-Two kept the November 19, 2026 date and answered with the official Extended Look a week after the clips.

At DigitalRadar, we tell the stories behind games without the sensationalism. Stay on the radar for the next GTA 6 news.