{ "id": "61478619-61ee-489e-a9f3-e99b834d5780", "created_at": "2026-04-06T00:12:20.799518Z", "updated_at": "2026-04-10T13:11:42.988179Z", "deleted_at": null, "sha1_hash": "271bce1f21ddbe58545648349a55687baea67322", "title": "Rockstar confirms cyberattack, leak of confidential data including GTA 6 footage", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 95720, "plain_text": "Rockstar confirms cyberattack, leak of confidential data including\r\nGTA 6 footage\r\nBy Alexander Martin\r\nPublished: 2023-01-10 · Archived: 2026-04-05 18:47:55 UTC\r\nGaming giant Rockstar confirmed on Monday that a hacker broke into its systems and stole confidential internal\r\ndata, including footage from the next highly-anticipated installment of its Grand Theft Auto series.\r\nIn statements posted to Twitter, Facebook and Instagram, Rockstar Games said it suffered a network intrusion that\r\nallowed someone to access and download “confidential information from our systems, including early\r\ndevelopment footage for the next Grand Theft Auto.”\r\n“At this time, we do not anticipate any disruption to our live game services nor any long-term effect on the\r\ndevelopment of our ongoing projects. We are extremely disappointed to have any details of our next game shared\r\nwith you all in this way,” the company said. “Our work on the next Grand Theft Auto game will continue as\r\nplanned and we remain as committed as ever to delivering an experience to you, our players, that truly exceeds\r\nyour expectations. We will update everyone again soon and, of course, will properly introduce you to this next\r\ngame when it is ready.”\r\nA spokesperson for the company told The Record that they will not be commenting on the situation beyond the\r\nstatements that were released. \r\nThe alleged hacker behind the leak claimed to be the same person who launched a wide-ranging attack on Uber\r\nlast week. \r\nOn a Grand Theft Auto fan forum, the individual shared a link to footage and clips from Grand Theft Auto 6, a\r\ntitle which Rockstar has not publicly confirmed is in development. \r\nThey attached images, videos, and source code as evidence and linked to the New York Times coverage of the\r\nUber security incident while describing it as their “previous work.” The hacker claimed to have \"GTA 5 and 6\r\nsource code and assets, GTA 6 testing build.”\r\nThe individual, writing in apparently fluent English and using the handle “teapotuberhacker,” said they were\r\nreachable via Telegram where their handle was Tea Pot. The person did not respond to requests for comment.\r\nInitially, the hacker offered data related to Grand Theft Auto 5, which has already been released, for nothing less\r\nthan $10,000 but claimed they would not sell any of the data related to Grand Theft Auto 6, which is still in\r\ndevelopment. \r\nThe account wrote around 1 a.m. EST “imma sleep for some hours now” before logging off in the early hours of\r\nSunday. Although they posted subsequently, their Telegram account has now been deleted. \r\nhttps://therecord.media/rockstar-confirms-cyberattack-leak-of-confidential-data-including-gta-6-footage/\r\nPage 1 of 4\n\nThe hacker also took to a message board on 4chan to discuss the incident, claiming to have gotten initial access to\r\nRockstar Games by social engineering an employee. They openly discussed wanting to negotiate with Rockstar\r\nand its parent company, Take-Two Interactive, but did not specify what they wanted to negotiate about.\r\nIn later messages, the hacker said people connected to Take-Two Interactive were “on” him and that he was unsure\r\nof what to do. With others on the message board, the hacker mulled the pros and cons of selling the stolen data and\r\nfootage or simply keeping it, wondering which would allow them to avoid legal peril. \r\nThe hacker’s last message said they plan to leak more of what they stole if Rockstar Games or Take-Two\r\nInteractive did not pay them. \r\nTake-Two Interactive was forced to file several DMCA infringement notices and takedown requests in an effort to\r\nget the leaked game footage off of YouTube and Twitter. \r\nBefore the company released a statement, a reporter from Bloomberg spoke with sources inside Rockstar Games\r\nwho told him that the leak was real.\r\nTo those who asked: There are several reasons this is a nightmare for Rockstar. One is that it'll disrupt\r\nwork for a while. Another is that it may lead management to limit work-from-home flexibility. The\r\nrepercussions of this leak might not be clear for quite a while\r\n— Jason Schreier (@jasonschreier) September 18, 2022\r\nGet more insights with the\r\nRecorded Future\r\nIntelligence Cloud.\r\nLearn more.\r\nNo previous article\r\nNo new articles\r\nhttps://therecord.media/rockstar-confirms-cyberattack-leak-of-confidential-data-including-gta-6-footage/\r\nPage 2 of 4\n\nAlexander Martin\r\nis the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow\r\nat the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal\r\non: AlexanderMartin.79\r\nhttps://therecord.media/rockstar-confirms-cyberattack-leak-of-confidential-data-including-gta-6-footage/\r\nPage 3 of 4\n\nJonathan Greig\r\nis a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since\r\n2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia.\r\nHe previously covered cybersecurity at ZDNet and TechRepublic.\r\nSource: https://therecord.media/rockstar-confirms-cyberattack-leak-of-confidential-data-including-gta-6-footage/\r\nhttps://therecord.media/rockstar-confirms-cyberattack-leak-of-confidential-data-including-gta-6-footage/\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://therecord.media/rockstar-confirms-cyberattack-leak-of-confidential-data-including-gta-6-footage/" ], "report_names": [ "rockstar-confirms-cyberattack-leak-of-confidential-data-including-gta-6-footage" ], "threat_actors": [ { "id": "d90307b6-14a9-4d0b-9156-89e453d6eb13", "created_at": "2022-10-25T16:07:23.773944Z", "updated_at": "2026-04-10T02:00:04.746188Z", "deleted_at": null, "main_name": "Lead", "aliases": [ "Casper", "TG-3279" ], "source_name": "ETDA:Lead", "tools": [ "Agentemis", "BleDoor", "Cobalt Strike", "CobaltStrike", "RbDoor", "RibDoor", "Winnti", "cobeacon" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434340, "ts_updated_at": 1775826702, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/271bce1f21ddbe58545648349a55687baea67322.pdf", "text": "https://archive.orkl.eu/271bce1f21ddbe58545648349a55687baea67322.txt", "img": "https://archive.orkl.eu/271bce1f21ddbe58545648349a55687baea67322.jpg" } }