INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Discord Users' Data Exposed in GTA 6 Leak Investigation

| 2026-08-25 10:01 CRITICAL MEDIUM DATA BREACH
JSON
Executive Summary
AI-generated
Someone leaked footage of the upcoming game Grand Theft Auto (GTA) 6 this month, and the game's publisher badly wants to know who. Take-Two Interactive, the publisher behind the GTA series, hit Microsoft and Discord with a subpoena on August 20, demanding IP addresses, phone numbers, linked Google and Xbox accounts, and OneDrive contents of certain server members from three affected servers going back to June 1 this year. The attack is believed to be carried out by an individual or group known as CyberLeek, who claims ideological motives and has been publishing game footage on the Solana network since August 17. This leak hunt could expose data belonging to thousands of Discord users, including Australian GTA 5 streamer Matthew Judge, with potentially hundreds or thousands of people having identifying information handed over to Take-Two as part of its investigation.
Technical Mitigations AI-generated
• Block or hunt for cryptocurrency tokens with suspicious activity, such as $CYBERLEEK on the Solana network. • Use a VPN to mask IP addresses when accessing Discord servers and OneDrive contents. • Monitor accounts for MachineGuid values and Microsoft account device IDs that may have been compromised by ShinyHunters cybercrime crew.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
Global Scope cryptocurrencycryptocurrency mediamedia
Incident Timeline
‎2026/08/25
The ShinyHunters gang targeted Anodot, a cloud analytics vendor holding persistent authentication tokens for its customers' Microsoft accounts and Windows installations.
infrastructure Windows
It’s also after their MachineGuid values and Microsoft account device IDs, which identify individual Windows installations and devices that access Microsoft services, respectively.
financial $60,000 toke
However, they can still collect trading fees from the toke , which reportedly reached up to $60,000 last week.
threat_actor ShinyHunters
In April, the ShinyHunters cybercrime crew stole 78.6 million Rockstar records without directly compromising any of the company’s internal systems.
Rather than compromising Rockstar, ShinyHunters targeted Anodot, a cloud analytics vendor that held persistent authentication tokens for its customers’
Gaining access to victims’ data by compromising third-party service providers holding that data is the ShinyHunters gang’s modus operandi .
data_breach 78.6 Rockstar records
In April, the ShinyHunters cybercrime crew stole 78.6 million Rockstar records without directly compromising any of the company’s internal systems.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
It’s also after their MachineGuid values and Microsoft account device IDs, which identify individual Windows installations and devices that access Microsoft services, respectively.
Metrics
financial
60,000
Toke
However, they can still collect trading fees from the toke , which reportedly reached up to $60,000 last week.
Metrics
data_breach
78,600,000
Rockstar Records
In April, the ShinyHunters cybercrime crew stole 78.6 million Rockstar records without directly compromising any of the company’s internal systems.
Intelligence Sources
Malware Bytes 2026-08-25