The 2022 Rockstar Data Breach: Full Timeline and Aftermath

The Biggest Pre-Release Leak in Gaming History

On the evening of September 18, 2022, an account named "teapotuberhacker" started posting video clips to GTAForums and 4chan. Roughly 90 of them. They showed in-development footage of a game Rockstar had never officially named: Grand Theft Auto VI. Here is how it happened, how Rockstar handled it and what it changed, drawing on reporting from Bloomberg [1], Kotaku [2], The Verge, IGN and court reporting after the attacker's arrest.

The Buildup

Rockstar had not officially acknowledged GTA VI's existence before the breach. Parent company Take-Two Interactive had referenced "groundbreaking" upcoming titles on investor calls [3], and Jason Schreier at Bloomberg had reported on the game's development restart in July 2022. That piece described a reworked development process intended to avoid the crunch associated with RDR2, a Vice City setting, and a dual-protagonist structure with a female lead.

September 18, 2022: The Leak

Late on September 18, clips began appearing on GTAForums' long-running GTA VI speculation thread. The account responsible, "teapotuberhacker," claimed to have obtained the footage by compromising internal Rockstar infrastructure. The clips showed:

• Pre-production gameplay of characters clearly identified as Lucia and Jason.
• A diner-robbery sequence closely resembling what would later appear in Trailer 1.
• Miami-style urban environments in a development-version state.
• Interior and exterior work-in-progress sequences with obvious placeholder assets.

The footage spread fast. Within hours, mirrors were up across Reddit, Twitter (now X), YouTube and Discord. Rockstar filed DMCA takedowns on the largest mirrors, but the clips were already everywhere.

September 19, 2022: Bloomberg and Rockstar's Statement

Jason Schreier's Bloomberg piece, published September 19 [1], was the first major mainstream coverage. It reported that Rockstar considered the breach significant and that source code may also have been exposed.

Later that day, Rockstar posted a short statement via Twitter and its Newswire [4]:

"We recently suffered a network intrusion in which an unauthorized third party illegally accessed and downloaded confidential information from our systems, including early development footage for the next Grand Theft Auto. ... We do not anticipate any disruption to our live game services nor any long-term effect on the development of our ongoing projects."

It was the first time Rockstar had publicly acknowledged that a new Grand Theft Auto was in development.

September 20-25, 2022: Follow-on Coverage

Major outlets ran substantial follow-ups:

• Kotaku's coverage focused on the moral ambiguity of watching and sharing the leaked footage [2].
• The Verge covered the technical questions about how the intrusion had happened.
• IGN and PC Gamer focused on community reactions and the fandom's divided response.

Fans were split. Many refused to watch the clips out of respect for the developers; others saw leaked-content viewing as a normal part of modern fan culture. That divide still exists today.

The Attacker: Arion Kurtaj and Lapsus$

Attribution was not immediate, but reporting and subsequent UK court documents identified the attacker as Arion Kurtaj, an 18-year-old UK national and member of the Lapsus$ hacking collective [5]. Lapsus$ had, in 2022, also compromised Nvidia, Samsung, Microsoft, and Uber in a sequence of social-engineering-driven intrusions.

Kurtaj had reportedly been on bail in connection with an earlier Lapsus$ matter at the time of the Rockstar intrusion. He used an Amazon Fire TV stick and a hotel TV reportedly because his primary equipment had been seized. The intrusion appears to have combined social-engineering access to Rockstar's internal Slack workspace with subsequent lateral movement.

Legal Outcome

Kurtaj's case went to trial in the United Kingdom in 2023. He was found by a jury to have committed the offenses but was found unfit to stand trial in the conventional sense. In December 2023 he was sentenced to an indefinite hospital order under the UK Mental Health Act [5]. The sentencing reportedly reflected the judge's assessment that Kurtaj continued to pose a risk of reoffending.

Rockstar's Remediation

Publicly, Rockstar said little beyond the initial statement. Internally, reporting suggests substantial changes, including:

• Tightened access controls across internal development systems.
• Changes to Slack and internal messaging security configurations.
• A reassessment of which employees had access to pre-release gameplay footage.
• A faster legal and DMCA response for future leaks.

The breach effectively set a new industry standard for handling leaks. The Newswire response, short, factual and not defensive, became a template cited in other incident responses.

Longer-Term Consequences

Fan Culture

The breach fast-forwarded fan knowledge about GTA VI by roughly a year. By the time Trailer 1 arrived in December 2023, much of the fandom already knew about the Vice City setting, the dual protagonists and the female lead. Trailer 1 became a moment of confirmation rather than discovery.

Rockstar's Trust Calculus

Rockstar has always run on extreme secrecy. The breach tested that model in public and, arguably, vindicated it: secrecy had not prevented the leak, but the response showed a leak did not meaningfully harm the project. Rockstar's later marketing (see the Marketing Campaign Analysis guide) has leaned even harder into deliberate silence.

Industry Security Culture

The 2022 AAA breach cluster (Rockstar, EA, Nvidia, Microsoft, Uber, Samsung) pushed publishers towards far more rigorous access controls. The Slack-compromise vector in particular became a case study at industry security conferences through 2023-2024.

The Source Code Question

Reporting at the time suggested portions of GTA V source code may also have been exposed, though Rockstar never publicly confirmed the full scope. Some observers linked later gains in modder-community knowledge of GTA V internals partly to leaked material. That link is contested; neither Rockstar nor independent security researchers have published a definitive analysis.

What the Breach Did Not Change

For all the noise, GTA VI appears to have carried on largely unchanged. The big elements in the September 2022 footage (Vice City, dual protagonists, the diner robbery) all appear in similar form in the official 2023 and 2025 trailers. That backs up Rockstar's original line that the leak would not cause "long-term effect on the development" of the game.

Why It Still Matters

By most measures, the 2022 breach is the most consequential pre-release leak in video game history. It:

• Forced the acknowledgement of a long-hidden project.
• Generated a year-plus of legal and community fallout.
• Contributed to major changes in industry security practice.
• Became a reference case in both cybersecurity and games journalism.

It was also a stress test for Rockstar's communications, and the studio came out of it looking stronger. Looking back, the calm, factual tone of the September 19 Newswire post was a quietly masterful piece of corporate communication.

Sources

1. Schreier, Jason. "GTA 6 Leak Is a Nightmare for Rockstar and Take-Two." Bloomberg, September 19, 2022. Earlier reporting: "Take-Two's Rockstar Games Is Developing New 'Grand Theft Auto' Title." Bloomberg, July 27, 2022.
2. Kotaku coverage of the Rockstar breach, September 19-23, 2022.
3. Take-Two Interactive 10-K filings and quarterly earnings commentary, 2021-2022.
4. Rockstar Games official Newswire statement, September 19, 2022.
5. UK court reporting on the sentencing of Arion Kurtaj, December 2023, including coverage from BBC News and The Guardian.