GTA 6 Leaks Explained: The 2022 Hack and the 2026 CyberLeek Videos

Update (October 2026): The 2022 leak turned out to be an early look at the real game. Rockstar announced Grand Theft Auto VI on December 4, 2023, and after two delays it is due on November 19, 2026, on PS5 and Xbox Series X|S. A second wave of gameplay leaks hit in August 2026, and a longer video surfaced on October 8; both are covered in the timeline at the end. Our original report follows, lightly corrected.

In September 2022, more than 90 videos of early Grand Theft Auto VI footage appeared online in a major leak. Fans quickly began combing the clips for clues about the characters, the setting and how the game plays.

How the footage got out

Rockstar confirmed the breach in a statement. It said an “unauthorized third party” had downloaded confidential information from its systems, including early development footage for the next Grand Theft Auto.

Rockstar added that it did not expect any long-term effect on development.

On September 22, 2022, City of London Police arrested a 17-year-old in Oxfordshire on suspicion of hacking. The National Crime Agency’s National Cyber Crime Unit supported the investigation.

What the leaked clips showed

According to Windows Central, the footage:

• appeared to come from an early development build, an unfinished version of the game
• showed two protagonists, including a Latina woman named Lucia
• pointed to a return to Vice City, the Miami-inspired setting of 2002’s GTA Vice City
• gave an extended look at robberies, vehicles and NPC interactions (NPCs are the non-player characters who fill the world)

Early builds change a lot before release, so not everything in the clips was expected to make the final game. Still, the footage gave fans their first real look at Rockstar’s next open world.

For many fans, it seemed to deliver what they had hoped for: a modern Vice City, a pair of criminal leads and the scale they expect from Rockstar. With Grand Theft Auto V out since 2013, the leak made the long wait for an official reveal feel even longer.

What happened to the hacker

A UK court later found that Arion Kurtaj was part of the Lapsus$ hacking group behind the Rockstar attack, PC Gamer reported. The 90 clips had been uploaded to the GTAForums fan site.

Kurtaj was sent to a secure hospital in 2023, for life or until doctors judged he was no longer a danger.

That has since changed. In July 2026, PC Gamer reported, citing BBC correspondent Joe Tidy, that Kurtaj had left the hospital and was in prison awaiting a retrial. At the time, the retrial was scheduled for November, the same month GTA 6 launches.

A second leak, four years later

In August 2026, gameplay videos of GTA 6 began spreading online from a hacker group calling itself CyberLeek. The first batch showed basketball, a six-star wanted level and the Leonida map. The timeline below covers each release.

Take-Two responded by asking a federal court for subpoenas seeking information from Microsoft and Discord about the leaks, Variety reported. A subpoena is a legal order to hand over information.

This time, Rockstar spoke to fans directly. In a statement on August 26, it said seeing the leaked gameplay “has been heartbreaking for our team” and asked players to wait to experience the game themselves, Variety reported.

The next day, Rockstar released its own footage. Grand Theft Auto VI: An Extended Look premiered on Netflix on August 27 with 27 minutes of in-game footage captured on PS5. It arrived on YouTube later that evening.

The 2026 CyberLeek leaks: a timeline

CyberLeek released its footage in short clips, often more than one a day. Rockstar has not authenticated any individual clip, and the footage appears to come from a development build, so anything in it can change before launch. GameEmpress covered each release in a separate report, linked under each date below.

• August 18: The first clips showed Jason Duval playing basketball, with each made shot raising a “Focus” meter, plus an apparent six-star wanted level, fuel and engine gauges, and a small devil icon that set off morality-system theories. CyberLeek also posted what it claimed was a map of Leonida, GamesRadar reported. Our full report.
• August 19: The “Taser” video, about two minutes long, showed Jason choosing between “Clone Key” and “Smash Window” at a parked car, fighting security guards who tried to arrest him, and a daytime cutscene on a boat. A Tate McRae song released in January 2025 played on the radio, which suggests the build is no older than that, Insider Gaming noted. Our full report.
• August 20: A daytime plane flight over Vice City showed a redesigned radio menu with the returning stations V-Rock and Emotion 98.3. It ended with Jason shooting the word “LEEK” into a wall, which Insider Gaming read as a sign the leaker could control a playable build. Our full report.
• August 21: “Hypercar” showed Jason pulling a driver out of a car that Forbes identified as the Truffade Thrax, with the struggle draining his stamina. Our full report.
• August 22: A second hypercar clip showed two gas station robberies, refuel and repair options at the pump, a police chase and Jason walking into a strip club as the video ended, Forbes reported. Around the same time, CyberLeek asked would-be advertisers to pay 400 XMR (Monero), then worth about $165,000, just to open talks, GamesRadar found. Our reports: the gas station clip and CyberLeek’s advertising offer.
• August 23: A night flight over Vice City International Airport showed a prompt naming a fishing spot for Common Snook, RockstarINTEL reported. CyberLeek also claimed that a complete build was stored in several places and would be released if the group were stopped, Insider Gaming reported. No evidence of that has been made public. Our reports: the airport flight and CyberLeek’s warning to Take-Two.
• August 24: Holders of CyberLeek’s $CYBERLEEK token were voting on which clip came next, and the Vice City flyover had won one of those votes, PC Gamer reported. A clip CyberLeek called “Nudist Town” followed, and the leaker said it might release a Lucia prologue next, GamesRadar reported. In one scene, a woman confronted and attacked Jason after he watched her through binoculars, NotebookCheck reported. Our reports: the token vote, the nudist town clip and the binoculars clip.
• August 25: A clip of more than three minutes inside the NINE1NINE nightclub showed Jason greeting NPCs and dancing, and a crowded beach video followed about an hour later, RockstarINTEL reported. Our full report on the nightclub clip.
• October 8: A ZIP file of about 25 minutes of footage titled “Extended Leek” surfaced and was attributed to CyberLeek, Dexerto reported. It showed missions, cutscenes, racing in Vice City and vehicle modification. Dexerto said it was unclear whether it came from the same source as the August clips, and that Rockstar had not addressed it.

Take-Two’s legal response

On August 20, Take-Two asked a federal court for DMCA subpoenas seeking records from Microsoft and Discord, with a September 4 deadline to respond, Kotaku reported. In a later request that it asked the court to seal, Take-Two said it “has identified one additional Discord user and obtained additional identifying information for a previously identified Discord user,” according to court filings first reported by TorrentFreak and covered by Dexerto on September 1.

The attention also drew scammers. Security researchers found fake GTA 6 installers carrying malware spreading in the days after the first clips appeared.