Report Date: 14 May 2026 Citation Style: Harvard Language: British English Topic: The September 2022 leak of Grand Theft Auto VI development footage, traced day-by-day from initial posting through hacker arrest.
On the evening of Sunday, 18 September 2022, a forum user calling themselves "teapotuberhacker" uploaded a 3GB archive containing roughly 90 short video clips of unfinished Grand Theft Auto VI gameplay to the long-running enthusiast site GTAForums. Within hours the clips had been mirrored across Twitter, Reddit, YouTube, Discord and Telegram, transforming what would otherwise have been a niche forum post into what journalists almost universally described as one of the largest leaks in the history of the video game industry (MacDonald, 2022; Murphy, 2022). The incident was unusual not only because of its scale, exposing more than fifty minutes of work-in-progress footage from a title that Rockstar Games had barely acknowledged in public, but because it unfolded in compressed time. From the first forum post to the public arrest of a teenage suspect in Oxfordshire, fewer than five days elapsed. This report reconstructs that compressed timeline day-by-day, drawing on contemporaneous reporting from The Guardian, BBC News, The Verge and Wikipedia's heavily-sourced summary, in order to clarify what is documented, what was claimed, and how the responses of Rockstar Games, Take-Two Interactive and law enforcement evolved across the week (Carpenter, 2023; Peters, 2022; Wikipedia contributors, 2026).
The first confirmed activity occurred late on Sunday 18 September, when the user "teapotuberhacker" created a thread on GTAForums titled "GTA 6 Videos & Source Code Leak" and attached a downloadable archive comprising approximately 90 separate .mp4 files. The footage spanned multiple stages of development, with some clips reportedly more than a year old at the time of posting, and depicted recognisable elements that have since been confirmed by the December 2023 reveal trailer: a modern-day Vice City setting, the dual protagonists Lucia and Jason, animation and physics tests, level layouts, NPC conversations, a diner robbery sequence and a strip club interior (MacDonald, 2022; Peters, 2022). In the same thread the poster claimed responsibility for the Uber security breach of the previous week and stated that the Grand Theft Auto files had been pulled directly from Rockstar's internal Slack workspace. They added that they were "looking to negotiate a deal" with Rockstar or its parent Take-Two Interactive and threatened to release source code and internal builds of both Grand Theft Auto V and VI if no agreement was reached (Peters, 2022; Wikipedia contributors, 2026).
By the early hours of Monday 19 September, Bloomberg's Jason Schreier had independently corroborated with sources inside Rockstar that the footage was authentic, removing any plausible deniability the company might have relied on (Peters, 2022). Shortly afterwards Rockstar Games published a short statement on Twitter describing the incident as a "network intrusion" and acknowledging that an unauthorised third party had "illegally accessed and downloaded confidential information from our systems, including early development footage for the next Grand Theft Auto" (Murphy, 2022). The statement lamented the manner in which the title had been "shared with you all in this way" but emphasised that work on the project would "continue as planned" and that no long-term impact on development was anticipated.
In parallel, Take-Two's legal team began a sweeping takedown campaign under the United States Digital Millennium Copyright Act. YouTube videos showing, reuploading or even substantively discussing the leaked clips were removed; GTAForums and Reddit moderators were contacted to scrub mirrored content; and the original forum thread was deleted, though by then the archive had propagated widely (MacDonald, 2022; Murphy, 2022). Take-Two's share price fell by more than six per cent in pre-market trading on the Nasdaq before recovering during regular hours after the official statement (Wikipedia contributors, 2026). Uber separately acknowledged the apparent link between the two breaches and confirmed it was cooperating with the Federal Bureau of Investigation and the United States Department of Justice, noting suspected affiliation with the Lapsus$ cybercrime collective.
Tuesday brought a notable shift in tone within the development community. As ill-informed commentary continued circulating about the supposedly poor "graphics" of the leaked footage, prominent developers including Neil Druckmann, Cliff Bleszinski, Rami Ismail and Alanah Pearce posted work-in-progress clips from their own projects to illustrate how raw mid-production footage typically looks, alongside expressions of sympathy for Rockstar staff (MacDonald, 2022; Wikipedia contributors, 2026). Analysts began to publish initial assessments: Andrew Uerkwitz of the Jefferies Group characterised the event as a public relations disaster that might dent staff morale but was unlikely materially to affect the eventual game's reception or commercial performance. Rockstar quietly disabled replies and comments across its social media accounts to slow the flood of leaked-content reposts (Carpenter, 2023).
Through Wednesday the hacker continued posting on GTAForums and on a Telegram channel, alternating between further excerpts, demands for negotiation and threats to release the Grand Theft Auto V source code in exchange for Ethereum payment. Forum staff later concluded, based on posting patterns and IP data, that the "teapotuberhacker" identity was operated collaboratively by at least two individuals, dubbed "Teapot" and "Lily", with only the former believed to be in actual possession of the hacked materials (Wikipedia contributors, 2026). Rockstar staff were reportedly instructed via internal Slack messages to be vigilant for further intrusion attempts, and Take-Two retained additional cybersecurity contractors.
On Thursday evening, 22 September, the City of London Police announced the arrest of a 17-year-old male in Oxfordshire as part of an investigation supported by the National Cyber Crime Unit and assisted by United States federal law enforcement (BBC News, 2023; Wikipedia contributors, 2026). The suspect was already on bail in connection with earlier hacks of BT/EE and Nvidia and was under police protection at a Travelodge hotel when, according to evidence later given at trial, he breached Rockstar using only an Amazon Fire TV Stick, a hotel television, a mobile phone and a Bluetooth keyboard. He had reportedly sent a Slack message to every Rockstar employee threatening to release the source code unless contacted. The City of London Police confirmed the arrest in a brief statement but did not name the suspect owing to his age. He was subsequently charged at Highbury Corner Youth Court with offences under the Computer Misuse Act 1990 and breach of bail conditions, and remanded to a young offender institution pending trial (BBC News, 2023).
In mid-2023 the suspect stood trial at Southwark Crown Court on twelve offences, including six counts of computer misuse, three of blackmail and two of fraud. He was deemed unfit to plead owing to autism, and a jury was instead asked to determine whether he had committed the acts charged; in December 2023 he received an indefinite hospital order on the grounds that he had expressed an intention to continue committing cybercrime (BBC News, 2023; Wikipedia contributors, 2026). Rockstar later disclosed that the recovery effort had cost approximately $5 million and thousands of staff hours, and the incident is widely credited with accelerating the company's later decision to recall remote workers to the office.
The five days between 18 and 22 September 2022 represent one of the most concentrated security and public-relations crises ever faced by a major video game publisher. The leak's velocity, from forum post to global news story to suspect arrest in under 120 hours, was matched only by the operational sloppiness of the perpetrator, whose use of a hotel-room Fire TV Stick became emblematic of an era in which sophisticated corporate intrusions could be executed with consumer hardware. For Rockstar Games, the documentary impact was paradoxically limited: the leaked footage prefigured almost every major feature subsequently confirmed in the 2023 trailer, yet anticipation for Grand Theft Auto VI only intensified. For the wider industry, the episode prompted hardened access controls on internal collaboration tools, particularly Slack, and contributed to a broader reassessment of remote-working policies inside high-value studios. Day-by-day, the timeline remains a useful case study in how rapidly an unverified forum upload can become a multi-jurisdictional criminal matter.
BBC News (2023) 'GTA 6 hacker Arion Kurtaj given indefinite hospital order', BBC News, 21 December. Available at: https://www.bbc.com/news/technology-67663128 (Accessed: 14 May 2026).
Carpenter, N. (2023) 'Rockstar finally responds to GTA 6 leak', Polygon, 19 September. Available at: https://www.polygon.com/ (Accessed: 14 May 2026).
MacDonald, K. (2022) 'Rockstar owner issues takedowns after Grand Theft Auto VI leak', The Guardian, 19 September. Available at: https://www.theguardian.com/games/2022/sep/19/rockstar-owner-issues-takedowns-after-grand-theft-auto-vi-leak (Accessed: 14 May 2026).
Murphy, M. (2022) 'Grand Theft Auto VI footage leaked after hack, developer Rockstar confirms', BBC News, 19 September. Available at: https://www.bbc.com/news/technology-62960828 (Accessed: 14 May 2026).
Peters, J. (2022) 'The GTA 6 leak is one of the biggest in video game history', The Verge, 19 September. Available at: https://www.theverge.com/ (Accessed: 14 May 2026).
Wikipedia contributors (2026) 'Grand Theft Auto VI', Wikipedia. Available at: https://en.wikipedia.org/wiki/Grand_Theft_Auto_VI (Accessed: 14 May 2026).