The 2022 GTA 6 Leak: What Happened

On September 18, 2022, a user going by “teapotuberhacker” posted a message to GTAForums with a link to roughly ninety files. Within minutes, it was clear this wasn’t a hoax. The files contained about fifty minutes of genuine, work-in-progress Grand Theft Auto 6 footage: early character animation tests, unfinished environments, and gameplay sequences set in a still-under-construction Vice City. It remains, by most measures, the largest leak in video game history, and unlike most leaks, almost none of it turned out to be fake.

The person behind it wasn’t part of some sophisticated criminal syndicate. It was Arion Kurtaj, a 17-year-old from Oxfordshire, England, and the founder of the hacking collective known as Lapsus$, a loosely organized group that had already made a name for itself breaching companies like Nvidia, Samsung, and Microsoft earlier that year. Kurtaj’s method for getting into Rockstar’s systems was almost mundane by hacking standards: he obtained compromised login credentials for a Rockstar employee’s internal Slack workspace, and from inside that workspace found links to internal development servers where the GTA 6 footage was stored. From there, it was simply a matter of downloading it.

What makes the story stick in people’s memory, though, is the detail of how he pulled it off. Kurtaj carried out the intrusion from a hotel room he was staying in at the time, under a court-ordered arrangement following an earlier, unrelated arrest, using nothing more than an Amazon Fire TV Stick, a hotel television, and a mobile phone. There was no elaborate hacking rig, no dark-web infrastructure befitting the scale of what he was about to pull off. It’s a genuinely strange footnote to one of the biggest corporate security failures in gaming history.

The response was fast. City of London Police arrested Kurtaj on September 22, 2022, just four days after the leak went live. He and another teenage member of Lapsus$ were later tried and convicted on charges including hacking, fraud, and extortion tied to this and other breaches the group had carried out. Because Kurtaj was found to have acute autism that made him unfit to stand trial in the conventional sense, the court ultimately handed down an indefinite hospital order rather than a standard prison sentence. That outcome closed the legal chapter of the story, though it didn’t fully resolve how satisfying an ending it was for anyone involved, Rockstar included.

For Rockstar, the immediate fallout was a strange kind of relief mixed with damage control. The studio confirmed the footage was genuine within a day, framed it publicly as early and unfinished, and pressed ahead with development largely as planned. Four years on, the leak is mostly remembered now as a strange, almost accidental preview of a game that turned out very differently in its finished marketing, a reminder that even a company as tightly controlled as Rockstar was, for one week in September 2022, only as secure as one employee’s compromised Slack login.