On 25 December 2023, just over fifteen months after the original Rockstar Games intrusion attributed to the Lapsus$ collective, a second wave of stolen material from that breach reportedly surfaced online. Mainstream gaming and security press described the event as the most consequential follow-on disclosure from the 2022 hack to date, with reporters indicating that the dump appeared to include the long-rumoured full source tree for Grand Theft Auto V, additional in-development scripting material associated with Grand Theft Auto VI, and a body of files connected to a long-cancelled or paused Bully follow-up (Abrams, 2023; Taylor-Hill, 2023; Thubron, 2023). The event quickly became known in coverage as the "Christmas dump" or "Christmas leak," a label that captured both the timing and the deliberate symbolism reporters identified in the release window.
This report summarises only what mainstream and trade outlets publicly stated about the dump. It does not reproduce filenames, directory structures, code excerpts, or asset identifiers beyond the broad characterisations that already appeared in press coverage. It does not point to, name, or describe the distribution channels used to spread the material, and it does not link to mirrors or archives. Where the reporting itself relied on unverified claims or speculation, that uncertainty is preserved and flagged. The aim is to capture, in journalistic terms, why the Christmas dump mattered, how it differed in character and severity from the September 2022 footage leak, how Take-Two Interactive responded, and what coverage suggested it implied about Rockstar's wider development pipeline.
The choice of 25 December was almost universally read by press as performative rather than coincidental. Bleeping Computer's account of the dump noted that links to the material were posted by an individual who explicitly framed the release as a tribute to Arion Kurtaj, the Lapsus$-affiliated hacker who had been sentenced earlier in December 2023 to an indefinite secure-hospital order in the United Kingdom for his role in the original Rockstar and Uber intrusions (Abrams, 2023). The post accompanying the release reportedly carried a "#FreeArionKurtaj" message and described Kurtaj as the person who "started all of this," framing the dump as a continuation of the campaign that began in September 2022 (Abrams, 2023).
Coverage from Insider Gaming, TechSpot and Silicon Angle emphasised that the holiday timing fit a broader pattern in which hacker communities have historically used Christmas Day as a high-visibility release window — guaranteeing maximum social-media traction at a moment when most corporate response teams, including Rockstar's, were on reduced staffing (Mendoza, 2023; Taylor-Hill, 2023; Thubron, 2023). The GTA Focal community blog, cited widely by trade press, observed pointedly that the leak surfaced "while employees are celebrating the holidays" (cited in Thubron, 2023). The framing reflected an older online tradition, sometimes traced back to warez-scene "Christmas releases" of the 2000s, in which leakers timed disclosures to coincide with festive periods both to embarrass victim companies and to maximise downstream reach before takedown machinery could mobilise.
Several outlets noted a more sombre reading: that the perpetrator appeared to time the release to overlap with the festive period precisely because Rockstar staff, having already endured the 2022 breach and its aftermath, would now experience a fresh disclosure on a holiday. Insider Gaming's piece framed this bluntly, observing that "damage is still being done" more than a year after the original incident (Taylor-Hill, 2023). The Christmas symbolism, in other words, served both as homage to an imprisoned hacker and as a deliberate twist of the knife.
Mainstream and trade press described the dump in broad rather than granular terms, but several distinct categories of material recurred across reporting.
The first and most heavily reported category was Grand Theft Auto V source material. Bleeping Computer reported that the upload was distributed widely and "appears to be legitimate" GTA V source code, while noting the publication could not independently verify authenticity (Abrams, 2023). TechSpot and Insider Gaming both reported that the initial publicly circulating archive was approximately four gigabytes in compressed form, while citing uncertainty about whether a larger, complete tree — rumoured in coverage to be around two hundred gigabytes — was also in circulation (Taylor-Hill, 2023; Thubron, 2023). Reporters consistently characterised the contents in general terms: engine code associated with Rockstar's in-house technology stack, scripting and gameplay logic, and a body of conceptual and reference imagery. The Verge, IGN, VGC and other outlets that ran follow-up coverage in the days afterwards similarly stuck to high-level descriptors rather than reproducing filenames or directory listings, in line with normal newsroom practice around stolen materials.
The second category concerned Grand Theft Auto VI. Coverage was careful here. Insider Gaming, TechSpot and Game Rant reported that "fresh Python code" related to GTA VI was present in the dump, but several outlets — and notably a developer commenter quoted in Insider Gaming's article — characterised the GTA VI-related scripting material as relatively mundane pipeline tooling for processing motion-capture and animation assets rather than gameplay code or design documents (Taylor-Hill, 2023). TechSpot additionally reported that the leaked material contained references confirming the project's previously rumoured internal codename, "Project Americas" (Thubron, 2023). Press coverage stressed that, unlike the September 2022 footage leak, the December 2023 dump did not appear to include playable builds, cutscenes, or substantial pre-rendered material from GTA VI; the GTA VI element was described as comparatively narrow.
The third and most novel category was a body of material connected to a Bully follow-up. Insider Gaming, TechSpot, Game Rant and Sportskeeda all reported that "every file" related to the unreleased sequel to 2006's Bully was claimed to be in the dump, although the precise scope was not independently verified by the outlets (Mendoza, 2023; Taylor-Hill, 2023; Thubron, 2023). Reporters characterised the Bully-related contents only in the most general terms — concept work, design materials, and code fragments — and did not reproduce filenames or specific asset names.
Finally, several outlets reported that the GTA V portion appeared to expose evidence of cancelled single-player expansion plans for the 2013 game, including expansions reportedly set in locations referenced previously in fan discussion. TechSpot summarised press claims that as many as eight cancelled single-player updates were referenced in the material, with some of the cancelled content later being repurposed for the GTA Online live-service product (Thubron, 2023).
Across all categories, the reporting tone was uniform: outlets described what the dump appeared to contain, attributed claims to community researchers or to vx-underground (which had spoken with the alleged leaker on Discord), and stopped well short of reproducing specifics that might assist further distribution (Abrams, 2023; Taylor-Hill, 2023).
The Bully-related component arguably drew the most fan attention because it offered the clearest signal about a project whose status had been ambiguous for almost two decades. The original Bully shipped in 2006 to strong reviews, and Rockstar leadership had on several occasions across the 2010s acknowledged interest in returning to the property without ever confirming an active sequel. The 2022 hack had already produced fragmentary indications that a follow-up had at minimum reached pre-production, but the December 2023 dump appeared, according to press accounts, to substantiate that the project had progressed considerably further than that before being shelved or paused (Mendoza, 2023; Taylor-Hill, 2023).
Coverage was careful not to overstate what could be inferred. TechSpot referred to Bully 2 as "the unreleased sequel to the 2008 game Bully" — note that the original release year is more accurately 2006, with a 2008 re-release as Bully: Scholarship Edition — and described the leaked material in single-line terms as "every one of Rockstar's files relating to Bully 2" (Thubron, 2023). Insider Gaming similarly used the phrase "every file" while attributing the claim to community sources rather than presenting it as independently verified (Taylor-Hill, 2023). The Spanish-language and aggregator coverage that followed, including Blaze Trends and Sportskeeda, expanded slightly on the cultural significance of the find but again avoided enumerating specific asset names (Mendoza, 2023).
What mainstream coverage did suggest was that the leaked material indicated a substantial, multi-year development effort. This was consistent with industry reporting from Bloomberg's Jason Schreier and others in prior years that a Bully follow-up had cycled through preproduction at Rockstar multiple times across the 2010s before being deprioritised in favour of GTA Online and GTA VI development. The Christmas dump did not, on press accounts, settle the question of whether the project was definitively cancelled or merely shelved. It did, however, give fans and journalists their first concrete external signal — beyond rumour — that meaningful work had occurred and then stopped.
Speculative interpretation (flagged): It is plausible, though not confirmed by Rockstar, that the appearance of so much Bully-sequel material in a single archive suggests the project reached an advanced enough state to have a coherent build environment before being deprioritised. This is informed speculation, not reporting, and the actual scope of the work cannot be confirmed from outside the leak.
Take-Two Interactive, Rockstar's parent company, moved quickly. Mainstream press reported that the publisher's legal team began issuing takedown notices to platforms hosting the material within hours of the initial release on Christmas Day, with action visibly continuing into 26 and 27 December (Taylor-Hill, 2023; Thubron, 2023). Insider Gaming reported that the original public link to the GTA V archive was "quickly removed" but that the material continued to spread through private group chats, Discord servers, and onion-routed channels — a familiar pattern in source-code leaks, in which initial public hosts can be suppressed but distributed redistribution is effectively impossible to halt (Taylor-Hill, 2023).
Bleeping Computer reported that it had contacted Rockstar for comment and received no response, attributing the silence to the holiday period (Abrams, 2023). Neither Rockstar nor Take-Two issued a substantive on-the-record statement in the immediate days following the dump. This contrasted with the company's relatively prompt confirmation of the September 2022 hack, in which Take-Two had filed an SEC disclosure and Rockstar had publicly addressed the leak via its corporate channels. The December 2023 silence was widely read by coverage as a tactical choice: with the source material already in circulation, public confirmation would have served only to amplify the disclosure.
Coverage also noted that Take-Two's takedown campaign extended to social-media reposts, archive sites, and code-hosting platforms. Several outlets observed that screenshots and small excerpts shared on Twitter/X received takedown action under the Digital Millennium Copyright Act within hours of being posted (Taylor-Hill, 2023; Thubron, 2023). Reporters were uniformly careful to describe this enforcement activity without identifying the specific channels being targeted.
The legal response was effective at making the dump harder to find through casual search, but reporting from BleepingComputer and others noted that the initial 24-to-48-hour window had already enabled wide enough redistribution that any expectation of full containment was unrealistic (Abrams, 2023). This is a familiar pattern in source-code leaks: the goal of post-hoc enforcement is harm reduction rather than recall.
Industry response divided along several lines.
Security press treated the dump as a significant case study in the long tail of corporate intrusions. Bleeping Computer's coverage situated the Christmas dump within the broader Lapsus$ saga, noting that members of the original group are now believed to operate within the loose-knit Scattered Spider collective, and that the social-engineering and SIM-swapping techniques pioneered by Lapsus$ continue to drive high-profile breaches across the technology and entertainment sectors (Abrams, 2023). The takeaway in security coverage was sobering: a successful intrusion against a major studio can continue to generate damaging disclosures more than a year after the perpetrators have been arrested, prosecuted and sentenced.
Gaming press focused on the implications for Rockstar's pipeline and for community modding. Insider Gaming highlighted the concern that public availability of GTA V engine and gameplay source could enable a new generation of sophisticated cheats and unauthorised online tools, with knock-on consequences for GTA Online — a product that, more than a decade after the base game's release, continued to be one of Take-Two's most consistent revenue contributors (Taylor-Hill, 2023). TechSpot echoed this concern and additionally noted that the same source material would, in principle, give modders and reverse-engineering enthusiasts unprecedented insight into the RAGE engine that underpins multiple Rockstar titles (Thubron, 2023).
Developer and community reaction within the games industry was mixed. The vx-underground research collective, quoted across multiple outlets, indicated that the leaker had told them the material had been in their possession since August 2023 and that the stated motivation was to "combat scamming in the GTA V modding scene," where individuals had reportedly been selling fake access to the source code (Abrams, 2023). This claimed motivation was reported with some scepticism in coverage — at least one outlet implicitly framed the homage to Kurtaj as the more credible explanation for the timing.
A more measured strand of commentary, notable in Insider Gaming's comments section and echoed in some developer reactions on social media, was that the GTA VI-adjacent Python material in the dump was not as exciting as headlines implied. The most-quoted developer reaction described that material as "very basic pipeline code to process FBX files for MotionBuilder," indistinguishable from comparable scripting used across the wider games industry (Taylor-Hill, 2023). This tempering helped distinguish the December 2023 event in coverage: the GTA V portion was the genuinely consequential release; the GTA VI portion was largely symbolic.
Comparison with the September 2022 footage leak was almost universal in coverage. Reporters across Insider Gaming, TechSpot, Bleeping Computer and the broader trade press agreed that the December 2023 dump was, in technical and commercial terms, the more severe event — even though the 2022 leak had received much wider mainstream and tabloid attention because of its visual, video-based nature. The 2022 leak had exposed a moment-in-time view of GTA VI's development, embarrassing in its informality but ephemeral. The 2023 dump, by contrast, made an entire shipped product's source — and elements of multiple unshipped projects — durably available, with consequences for anti-cheat, intellectual property, and competitive product development that would persist for years (Abrams, 2023; Taylor-Hill, 2023; Thubron, 2023).
What mainstream coverage suggested the dump revealed about Rockstar's pipeline can be summarised in three observations. First, the studio had continued to maintain a multi-project portfolio through the 2010s even as GTA Online absorbed an increasing share of resources, with the cancelled single-player expansions for GTA V illustrating that calculus most clearly. Second, a Bully follow-up had progressed materially further than public messaging had ever acknowledged before being shelved or paused. Third, GTA VI's tooling and asset pipeline — at least the elements visible in the dump — appeared to be conventional rather than exotic, in line with what would be expected of a long-running RAGE-based production.
The following items in this report are reported fact, sourced to mainstream press: that a leak occurred on 25 December 2023; that it was attributed in coverage to material originally stolen in the 2022 Rockstar intrusion; that the release was framed by the uploader as a tribute to Arion Kurtaj; that mainstream press described the dump as containing GTA V source material, GTA VI-related Python pipeline scripting, and Bully sequel material; that Take-Two issued takedowns; and that vx-underground reported the leaker's claimed motivation as anti-scamming in the modding scene (Abrams, 2023; Mendoza, 2023; Taylor-Hill, 2023; Thubron, 2023).
The following items are reported as press claims rather than independently verified fact: that the GTA V source tree was complete; that "every" Bully sequel file was included; and that as many as eight cancelled single-player expansions were referenced in the material. Press themselves attributed these to community researchers and screenshots rather than to direct verification (Taylor-Hill, 2023; Thubron, 2023).
The following items are flagged speculation: that the Christmas timing reflected a deliberate continuation of older warez-scene release traditions; that the volume of Bully-sequel material implies the project reached an advanced production state before being paused; and that the GTA VI scripting material's mundane nature suggests Rockstar's pipeline tooling is conventional. These are reasonable inferences from the reporting but are not themselves established facts.
The following items remain unknown and should not be treated as established: the precise total scope of the dump; whether further material from the 2022 intrusion remains undisclosed in private hands; whether the Bully sequel is definitively cancelled or merely paused; and whether the December 2023 disclosures have had any measurable effect on GTA VI's development schedule. As of the press coverage reviewed for this report, none of these questions had been answered on the record by Take-Two or Rockstar.
Confidence levels: core event (high); broad contents categorisation (high); completeness of any individual category (low–medium); long-term pipeline implications (medium with caveats); cancellation status of Bully follow-up (low — informed speculation only).
Abrams, L. (2023) 'GTA 5 source code reportedly leaked online a year after Rockstar hack', Bleeping Computer, 25 December. Available at: https://www.bleepingcomputer.com/news/security/gta-5-source-code-reportedly-leaked-online-a-year-after-rockstar-hack/ (Accessed: 14 May 2026).
Mendoza, A. (2023) 'GTA V source code: Everything leaked so far', Sportskeeda, 26 December. Available at: https://www.sportskeeda.com/gta/gta-v-source-code-everything-leaked-far (Accessed: 14 May 2026).
Taylor-Hill, G. (2023) 'GTA 5 Source Code, GTA 6 Code, and Bully 2 Files Leaked, Reports Claim', Insider Gaming, 25 December. Available at: https://insider-gaming.com/gta-5-source-code-leaked/ (Accessed: 14 May 2026).
Thubron, R. (2023) 'Rockstar Games faces another leak as GTA V source code, GTA VI and Bully 2 details appear online', TechSpot, 26 December. Available at: https://www.techspot.com/news/101322-rockstar-games-faces-another-leak-gta-v-source.html (Accessed: 14 May 2026).