Take-Two's DMCA subpoenas ask Microsoft and Discord for telemetry, device IDs and OneDrive files

Take-Two Interactive has asked a federal court in New York to issue DMCA subpoenas compelling Microsoft and Discord to hand over records that could identify whoever is behind the recent Grand Theft Auto 6 leaks ^[1]. Two separate requests were filed on August 20, one directed at Microsoft and one at Discord, with a return date of September 4 ^[2][9] - roughly two weeks after filing ^[19].

The important detail is not the franchise. It is that this is not a lawsuit against anyone. Take-Two is not accusing Microsoft or Discord of involvement; it is using a process under the Digital Millennium Copyright Act that lets copyright owners request information identifying someone suspected of sharing their material without permission ^[3]. Neither filing publicly names the person behind the leaks, and including a Discord server in the request is not an accusation against that server's owner or its members ^[16].

What the filings ask for is broad. Take-Two is seeking IP addresses, phone numbers, linked Google and Xbox accounts, device identifiers, Microsoft telemetry and relevant OneDrive files connected to accounts that may be tied to the Cyberleek persona ^[8]. The Microsoft request also covers users who may have communicated in several Discord servers connected to the leaks since June 1, including their email addresses, phone numbers and login IP addresses ^[11] - a lookback window of roughly 80 days before the filing date ^[20]. Beyond identity, Take-Two wants device IDs, records showing whether particular files or programs appeared on those devices, and GTA, Rockstar or Cyberleek files stored in OneDrive ^[12]. It has additionally asked Microsoft for internal business and investigative records relating to what the filing describes as Microsoft's own investigation of Cyberleek ^[10].

The Discord filing names Cyberleek alongside two other accounts, CinematicRockstar and Surfer24k, and lists cyberleek_west and surwest as replacement names for Surfer24k ^[14]. It reaches the Odyssey.gg and Odyssey communities and a server used by editors for the GTA YouTuber Matthew "DarkViperAU" Judge ^[15]. Exhibits show the wider effort: the Microsoft filing lists a "Github DMCA Notice," and the Discord filing includes earlier takedown notices sent to Discord ^[17].

Read as a product document rather than a legal one, this is an inventory of what a consumer platform retains. Login IPs and linked accounts are ordinary subscriber data. Telemetry showing which programs touched a device, and the contents of a user's cloud drive, are a different category, and they are being requested through the same instrument. Every logging and sync feature shipped for support or convenience becomes a discovery target the moment a rightsholder points at an account.

Context on the underlying leak: the clips began appearing on August 18 from an account called CyberLeek ^[6], the persona used the attention to promote a meme coin ^[4], and Rockstar responded with DMCA claims ^[18]. A GTAForums user, Vice Cit, reported the account moved crypto through KuCoin and had taken in around $50,000 with roughly $391,000 in unsold tokens ^[21], arguing that because the exchange requires KYC verification, a subpoena there would yield the account holder's identity and transaction and session records ^[22].

What to watch: whether the court confirms the subpoenas issued at all, since at publication it had not publicly done so and neither company had responded ^[5]; whether Microsoft or Discord contests the scope, particularly the OneDrive and telemetry items ^[12]; and whether the server-wide request since June 1 is narrowed ^[11]. CyberLeek had not posted since August 20 but claimed more footage was coming ^[7]. Rockstar had issued no statement and was still planning its extended GTA 6 segment on Netflix for August 27 ^[13].