GTA 6 2022 leak: the footage, Rockstar's response and the hacker
The September 2022 GTA 6 leak explained: what 90 stolen clips showed, how Rockstar responded, and where hacker Arion Kurtaj's November 2026 retrial stands.
Confirmed. Rockstar Games or Take-Two said this on the record.
GTA 6 launches on PS5 and Xbox Series X|S on November 19, 2026, four years after the biggest leak in Rockstar's history. The man a court found responsible, Lapsus$ hacker Arion Kurtaj, is due back in court on November 9, ten days before launch, according to a post from his barristers. That the leak happened was never in doubt. Rockstar confirmed it within days.
What leaked in September 2022
In mid-September 2022, a GTAForums user going by "teapotuberhacker" posted 90 videos from a test build of the next Grand Theft Auto, PC Gamer reported. The poster also claimed to have "GTA 5 and 6 source code and assets". Clips spread across YouTube, Reddit and Twitter before the takedowns caught up.
The footage was plainly unfinished. PC Gamer described a playable character named Lucia robbing a waffle restaurant with a partner named Jason while an on-screen timer counted down to police dispatch. The clips had placeholder dialogue text, mannequin-like NPCs clipping through scenery and a GTA 5 police car with "V.C.P.D." painted on it. Other clips pointed to a Vice City setting and a WhatsApp parody called WhatUp. Some file names included the word "Americas", a few clips seemed to run on a PS4 dev kit, and a source told PC Gamer that most of the videos were probably attached to QA bug reports. All of that suggested some of the material was years old.
How Rockstar and Take-Two responded
Rockstar acknowledged the breach on Monday, September 19, 2022, in a statement quoted by GamesRadar+. The studio said an unauthorized third party had "illegally accessed and downloaded confidential information" from its systems, including early footage of the next Grand Theft Auto. It said it was "extremely disappointed" that players had seen the game this way. It also said it expected no long-term effect on development and that work would continue as planned.
Take-Two used copyright claims to get the videos removed from mainstream sites, PC Gamer said. GamesRadar+ pointed to an Axios report that the hacker claimed to have more data and wanted to "negotiate a deal". The same person also claimed responsibility for a breach at Uber, and the FBI was investigating.
Years later, Rockstar co-studio head Aaron Garbut said that having unfinished footage hacked and leaked had felt deeply invasive.
The arrest and the 2023 verdict
On September 22, 2022, City of London Police arrested a 17-year-old in Oxfordshire on suspicion of hacking, in an investigation supported by the National Crime Agency. He was charged with two counts of computer misuse and two counts of breaching bail, and he appeared at Highbury Corner Youth Court on September 24, GamesRadar+ reported. Police did not publicly link the arrest to Rockstar at the time. Journalist Matthew Keys reported that it was tied to both the Rockstar and Uber attacks.
In December 2023, the case reached its verdict in a London court, Engadget reported, citing the BBC. The hacker, by then 18 and named as Arion Kurtaj, had broken into Rockstar's systems from a Travelodge. He was staying there under police protection while on bail, and he used an Amazon Fire TV Stick, a smartphone, a keyboard and a mouse. Doctors found him unfit to stand trial because of acute autism, so the jury only had to decide whether he had carried out the acts, not whether he had criminal intent. It found that he had. A mental health assessment said he still intended to return to cybercrime, so the judge ordered him into a secure hospital with no end date.
The court heard Rockstar's claim that the hack cost it $5 million and thousands of hours of staff time. Kurtaj's lawyers argued that GTA 6's first trailer, which drew 128 million views in four days, showed the leak had done no serious harm. A second Lapsus$ member, a 17-year-old who could not be named, received an 18-month youth rehabilitation order.
Out of hospital and back in court
In July 2026, BBC correspondent Joe Tidy said on Bluesky that Kurtaj had left hospital and was in a normal prison awaiting retrial, PC Gamer reported. Police have said almost nothing more. On October 10, Notebookcheck reported, citing GTAVice.net, that a LinkedIn post by Red Lion Chambers said the case would open on November 9 at Woolwich Crown Court. That date comes from his lawyers rather than the court, and trials can be postponed. No one has explained publicly how the new proceedings fit with the earlier finding that he was unfit to stand trial.
What the leak got right, and what is still open
Measured against what Rockstar has since confirmed, the stolen clips were accurate on the big points:
- Two protagonists, Lucia and Jason: true. They lead the game (our full protagonist explainer).
- Vice City: true. It is one of six confirmed regions of Leonida.
- "Americas" in the file names: consistent with the game's history. Project Americas was GTA 6's original codename. It began as a plan for a map covering large parts of North and South America and was later cut down to Miami and the area around it (how the setting rumours played out).
- The diner robbery: GamesRadar+ spotted what looks like the same Hank's Waffles heist in GTA 6: An Extended Look on August 27, 2026, this time in near-final form. Rockstar hasn't said whether bringing it back was a deliberate nod.
The leak's visuals were the misleading part. Footage taken from bug reports years before release said little about how the finished game would look, as the side-by-side with the 2026 version shows.
Some questions are still unanswered. The hacker said he had source code, but Notebookcheck notes that no build has ever surfaced. Rockstar said the leak would have no long-term effect on development. The game was delayed twice after that, but Rockstar never blamed the breach for either delay (full delay timeline). Nothing public shows whether the "deal" the hacker wanted ever came to anything. The CyberLeek clips that circulated in 2026 came from a separate source and are not part of the 2022 breach.
The next date to watch is November 9, when Kurtaj's case is due to open, ten days before Lucia and Jason finally arrive in a finished game.
