The GTA 6 leak timeline, from the 2022 hack to CyberLeek

September 2022: a hotel TV, a Fire Stick, and 90 clips

The first GTA 6 leak happened before Rockstar had even announced the game existed. In September 2022, a hacker using the name TeaPotUberHacker got into Rockstar's internal Slack workspace and posted 90 video clips from an early build, along with some source code, to the fan site GTAForums. The access method is the detail that made this leak famous rather than just damaging. The hacker was 17 year old Arion Kurtaj, a British member of the Lapsus$ hacking group, and he was already on bail for hacking Nvidia and BT's EE network when he did it. Police had moved him to a Travelodge hotel in Bicester, Oxfordshire, for his own protection after a rival faction doxxed him online, and confiscated his laptop as a bail condition. Kurtaj got around that with an Amazon Fire TV Stick plugged into the hotel room television, his mobile phone, and a cheap keyboard and mouse. That was the entire setup used to breach one of the biggest game studios in the world. He used the access to blackmail Rockstar over Slack before posting the clips publicly. Rockstar has said the incident cost the company over $5 million and thousands of hours of staff time.

December 2023: unfit to stand trial, sentenced anyway

Kurtaj's case did not end in a normal criminal trial. Doctors found him severely autistic and psychologically unfit to stand trial in the ordinary sense, so a jury was asked only to determine whether he had committed the acts, not whether he was criminally responsible for them. It found that he had. On December 21, 2023, the judge ordered Kurtaj held indefinitely in a secure psychiatric hospital rather than prison, citing a mental health assessment that found he "continued to express the intent to return to cyber-crime as soon as possible" and was "highly motivated" to do it. That indefinite hospital order, not a fixed sentence, is what actually followed the 2022 leak for the next two and a half years.

July 2026: moved to prison, awaiting a retrial that lands the same month GTA 6 ships

On July 14, 2026, a UK court lifted reporting restrictions that had covered Kurtaj's case, and it emerged that he had already been moved out of the psychiatric hospital and into a standard prison. A later medical reassessment found him fit to stand trial after all, reversing the basis for the 2023 hospital order. He is now awaiting a full criminal retrial, currently scheduled for November 2026, the same month GTA 6 is due to launch. Whether that timing is coincidence or the court calendar simply landing there is not something either side has addressed publicly. What's confirmed is only the fact of the retrial date and that Kurtaj remains in custody, not free, despite some social media claims to the contrary in the weeks after the restrictions lifted.

April 2026: a different hack, a different target, no game footage

Between the 2022 leak and the 2026 gameplay leaks, Rockstar was hit by a separate, unrelated breach that gets folded into "the GTA 6 leaks" in casual conversation but shouldn't be. On April 11, 2026, a group called ShinyHunters claimed it had compromised Rockstar's Snowflake data warehouse by stealing authentication tokens from Anodot, a third party cloud cost monitoring vendor Rockstar used. ShinyHunters demanded a ransom and set a deadline; when it wasn't met, the group published what it said were more than 78 million records. The contents were internal analytics: service performance data, support workflows, fraud detection and anti-cheat testing notes, and financial reporting tied to GTA Online and Red Dead Online, including a figure showing GTA Online had averaged roughly $1.32 million a day in revenue between September 2025 and April 2026. None of it was GTA 6 game footage, code, or assets. Rockstar's statement described the breach as exposing "a limited amount of non-material company information" with no impact on players or operations, and the leaked revenue figures have not been officially confirmed by Rockstar or Take-Two.

This is worth separating clearly from the other two leaks: the 2022 and 2026 CyberLeek incidents put unreleased GTA 6 material in public hands. The April 2026 ShinyHunters breach did not. It exposed business data, not the game.

August 18 to 27, 2026: CyberLeek's daily drip

The third leak started August 18, 2026, when clips began appearing under the name CyberLeek, watermarked and posted through a site on an ar.io gateway alongside a Solana memecoin, $CYBERLEEK, that had already been trading for three days. What followed was close to daily: basketball and driving gameplay and an alleged map image on the 18th; a taser scene and a new drug mechanic called Zombix on the 19th; an aerial view of Vice City on the 20th; a hypercar clip on the 21st, a day after Take-Two filed its first federal subpoenas against Microsoft and Discord on August 20; gas station and strip club footage on the 22nd and 23rd; a night flyover and Lucia footage on the 24th; four separate releases in one day on the 25th; Rideout Customs footage and story spoilers from Lucia's prologue on the 26th, the same day Rockstar finally issued a public statement; and harbor footage on the 27th, the day the official Extended Look premiered on Netflix. We covered who CyberLeek claims to be, the memecoin's timing problem, and the impersonator accounts separately. This post is about where that episode sits on the larger timeline: it is the third distinct leak event in four years, not the first, and it was already the second of 2026 alone.

"Our colleague": CyberLeek's claimed link to the 2022 hack

CyberLeek has directly invoked the 2022 leak. Responding to impersonator accounts in a Telegram statement, the group referred to Arion Kurtaj as "our colleague," grouping his 2022 leak in with its own, according to accounts tracking the channel. That is CyberLeek's own claim, not a finding by Rockstar, Take-Two, or any investigator. There is no public evidence tying CyberLeek to Kurtaj, to Lapsus$, or to the 2022 breach beyond that single line, and the two incidents look nothing alike: one was a solo teenager exploiting a specific access failure while in police protective custody, the other is a branded, sustained operation with a manifesto and a tradeable token attached. Calling someone a colleague costs nothing and proves nothing on its own.

How the three leaks actually differ

Laid next to each other, the three incidents share a target and not much else. The 2022 leak was a single identified person, arrested and prosecuted, motivated by nothing more complicated than a hacker showing off and then trying to extort the company he'd broken into. The April 2026 ShinyHunters breach was financially motivated extortion against a cloud vendor, aimed at business data rather than the game itself, and Rockstar disclosed it, however minimally, rather than staying silent. The August 2026 CyberLeek leaks are still unattributed to any named person, dressed in the language of a consumer protest, and tied to a cryptocurrency token that started trading before the protest did. Treating all three as one continuous story is why so much coverage conflates them. They are three different actors with three different motives, and the only thing connecting them on the record is that they all targeted the same publisher in the same four year window before the same release date.

What is still unknown

Who is actually behind CyberLeek, whether it is one person or several, and how the material was obtained have not been established. Whether Kurtaj's November 2026 retrial has any connection to CyberLeek's claimed reference to him, beyond that one Telegram line, is unconfirmed and looks unlikely given how differently the two operations are run. Whether Microsoft and Discord fully complied with Take-Two's subpoenas targeting CyberLeek, which sought data by September 4, 2026, has not been made public. And whether ShinyHunters or anyone else still holds unreleased Rockstar data from the April breach that hasn't surfaced yet is not something Rockstar has addressed. GTA 6 still launches November 19, 2026 on PS5 and Xbox Series X and S regardless of any of it.