Take-Two subpoenas Microsoft and Discord for device IDs of GTA 6 leaker and server members

Take-Two Interactive filed two DMCA subpoenas in the Southern District of New York on August 20, demanding that Microsoft and Discord identify the person or persons behind the "CyberLeek" persona responsible for this week's Grand Theft Auto 6 gameplay leaks.

Scope of Information Requested

Take-Two is seeking more than just names. The subpoenas request the following data for every account that communicated in three named Discord servers since June 1:

• MachineGuid and MSA device identifiers
• Registration and last-login IP addresses
• Phone numbers
• Linked Google and Xbox connections
• OneDrive contents

Both subpoenas, filed by Dale Cendali and Joshua Simmons of Kirkland & Ellis, set a September 4 deadline.

Technical Details on MachineGuid

MachineGuid is a Windows value generated during installation. According to Microsoft's own support documentation, it remains stable across hardware changes unless the OS drive is replaced.

Attachment A asks Microsoft to return that identifier for every account that was a member of, or communicated with, any of the three listed Discord servers between June 1, 2026 and the present — in addition to the three handles named in the filings.

Named Discord Servers

The Discord subpoena names three servers:

• Ødyssey.gg (guild ID: 1517326120867991592)
• "! Odyssey" (1127436882800816149)
• DarkViperAU (268280696601051136)

The Microsoft subpoena describes the first server as a "cheat community" and labels it the "operator's home." It also demands device telemetry where certain "tool/file artifacts" were present on a system, though no list of those artifacts appears anywhere in the exhibit.

GitHub Takedown Notice

Take-Two's petition directs the Microsoft subpoena to the company as GitHub's service provider, not as the operator of Xbox or OneDrive.

The predicate takedown notice, filed as an exhibit, was sent on August 19 by Take-Two IP paralegal Alex Aviles to GitHub's copyright address over a single repository: zyrexdz/cyberleek-leak-research. It states that the repository "must be completely disabled, there are no remedies to rectify this clear case of infringement."

At the time of writing, the GitHub repo is public with nearly 500 stars, more than 30 forks, and a commit pushed at 16:18 UTC.

Account and Server ID Analysis

Discord account and server IDs encode their creation time. Decoding the IDs in the filings reveals:

• CyberLeek account: Created January 10, 2019
• DarkViperAU server: Created January 10, 2017
• Ødyssey.gg server: Created June 19, 2026 — 18 days after the start of the June 1 records window

Australian creator Matthew "DarkViperAU" Judge, whose server the filings describe as an "editors' server," denied any knowledge in a post on X, writing: "I don't know anything."

The Discord petition also lists 1517326120867991592 as a user ID belonging to the handle Surfer24k, while both subpoena attachments list the same number as the Ødyssey.gg server ID.

Ongoing Leak Activity

A sixth gameplay video leak appeared on August 21, six days before Grand Theft Auto 6: An Extended Look premieres on Netflix. Rockstar's parent company was itself hacked by ShinyHunters in April, while CyberLeek claims to have a full, working build and has published a manifesto attacking digital-only preorders.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, and reviews in your feeds.