Take-Two Interactive filed two subpoenas in the Southern District of New York on 20 August 2026, seeking to identify whoever is behind the Cyberleek persona leaking Grand Theft Auto VI footage.

The target is one person, or a small number of people. The request is not scoped that way at all.

What is being demanded

From Microsoft and Discord, for every account that communicated in three named Discord servers since 1 June:

  • MachineGuid values and Microsoft account device identifiers
  • Registration and last-login IP addresses
  • Phone numbers
  • Linked Google and Xbox connections
  • OneDrive contents

The filings were made by Dale Cendali and Joshua Simmons of Kirkland & Ellis. Microsoft and Discord have until 4 September to respond.

Read that list again

OneDrive contents.

Not metadata. Not filenames. The contents of people's personal cloud storage — the tax documents, the photographs, the coursework, the things a person puts in a folder because it is theirs — for everyone who happened to type a message in a chat server since the start of June.

MachineGuid is worth understanding too. It is an identifier Windows generates when the operating system is installed. It is not a cookie you can clear or an account you can abandon; it persists across logins and applications and ties a physical machine to everything that machine does. Handing it over is closer to a fingerprint than to an IP address.

The scale problem

One of the three named servers belongs to DarkViperAU, an Australian streamer with a large GTA community. He has posted on X that he had nothing to do with the leak and knew nothing about it.

His server, and the others, contain hundreds or thousands of people with no known connection to any leak. All of them are in scope. The criterion is not suspicion; it is having spoken in a room.

That is a dragnet. Not a description of one — the actual thing, defined by presence rather than conduct.

The mechanism is the point

A DMCA subpoena lets a copyright holder demand identifying information from a service provider without filing a lawsuit first. There is no judge weighing evidence, no defendant, no adversarial hearing. A clerk issues it.

The design intent is narrow: a rights holder who can point at infringing material gets the identity of the person who posted it, so a real case can then be brought.

What is happening here is a different thing wearing that mechanism. The infringer is unidentified, so the request covers everyone who might be near them — and it reaches for categories of data, particularly private file contents, that have nothing to do with establishing who uploaded a video.

If a police force wanted the contents of thousands of people's cloud storage, it would need a warrant, particularity, and a judge. A corporation pursuing a copyright claim has filed paperwork and set a two-week deadline.

This is the year's pattern, from the other direction

We have spent this month writing about regulators discovering that penalties needed to be larger — Uber's €825 million, TikTok's $400 million — each one about a company holding data it should not have held, or using it in ways it should not have.

Here a company is asking two of the largest data holders in the world to hand over other people's personal files, and the legal instrument requires nobody to ask whether that is proportionate. The privacy regime that fines Uber €825 million for automated decisions has no equivalent gatekeeping on this.

Neither Microsoft nor Discord has publicly said what it will do. Both can object. Whether either does is the thing to watch, because a subpoena of this scope becomes normal the first time it is complied with quietly.

If you are in one of those servers

  • You do not need to have done anything. The criterion is having posted since 1 June.
  • Review what is in your OneDrive, and understand that the request covers contents, not just the fact of an account.
  • Check your linked accounts — Google and Xbox connections are explicitly named.
  • Watch for Microsoft's or Discord's notification. Providers often notify affected users when they can; whether that happens here is unknown.
  • This is not legal advice, and anyone genuinely worried should get some.

What is not established

  • Whether Microsoft or Discord will comply, object, or narrow the request.
  • Whether either will notify affected users.
  • How many accounts are actually in scope. Nobody outside has the server member counts as of 1 June.
  • Whether a court will review the subpoenas. DMCA subpoenas do not require it unless someone moves to quash.
  • Whether Cyberleek was ever in any of those servers. That appears to be the theory; it has not been demonstrated publicly.