GTA VI Leak: When Your Slack Workspace Is the Vault

Quick Answer — Days before Uber’s September 2022 breach made headlines, Rockstar Games confirmed that a network intrusion had leaked early footage of Grand Theft Auto VI: 90+ development clips posted to GTAForums by an account claiming to be the hacker. Reporting and subsequent court documents linked the actor to the same Lapsus$-affiliated teenager implicated in the Uber compromise — a chain allegedly beginning with helpdesk social engineering and Slack/Confluence access. The lesson: your collaboration suite is a source-code exfiltration highway, and helpdesk identity verification is a security boundary, not a formality. (Note: this article covers a security event; see web vulnerability primers for background.)

What happened

On September 18, 2022, a forum user posted 90+ videos of in-development GTA VI gameplay to GTAForums. Per Rockstar’s published statement and contemporaneous reporting:

• Entry via collaboration tools. The actor allegedly gained access to Rockstar’s Slack and Confluence by compromising credentials — reporting on the Uber case, where the same actor was implicated, describes the pattern: helpdesk social engineering of an employee/contractor, MFA-fatigue push bombing, and pivot to internal tooling.
• The clips were already there. The development footage was accessible from the compromised collaboration environment — the actor did not need to breach a build server; the workspace held the crown jewels.
• Rockstar’s acknowledgment. The company confirmed a “network intrusion” and the leak’s authenticity, describing the material as early development footage. A sourced claim in the forum thread (hotly discussed, never officially confirmed) alleged the actor had also downloaded source materials; Rockstar’s statement stuck to the footage.
• The same actor as Uber. Reporting and court documents tied the Lapsus$-linked 17/18-year-old to both intrusions in the same month — a single adversary, two giants, one technique family: human-layer entry, then collaboration-suite pivot.

Impact and numbers

The exfiltration path, in one diagram

 helpdesk/social target
         |
  credential + MFA fatigue
         |
  Slack / Confluence session
         |
  dev clips staged in workspace
         |
  forum post (GTAForums)
         |
  90+ clips public
  (no build server touched)

 lesson: the collaboration
 suite WAS the vault

Timeline

Why it still matters in 2026

Because in 2026 the collaboration suite holds more IP than the version-control system and has weaker access tiers. The GTA leak crystallized a threat model every security team now plans against: one phished or socially-engineered contractor plus Slack equals a marketing-event catastrophe. The controls it accelerated: helpdesk verification protocols (callback to registered numbers, video verification, manager confirmation for credential/MFA resets), DLP on collaboration platforms (flagging bulk media download), session anomaly detection on workspace logins, and treating Confluence/admin wikis as production secrets stores — because attackers do. The leak also normalized a hard truth: you cannot un-leak a cultural moment. Rockstar’s graceful pivot (“a preview of the next chapter”) became crisis-comms case material, but the control lesson is purely technical: compartmentalize what lives in Slack.

Detection and hardening takeaways

• Harden the helpdesk. Credential and MFA resets are privileged operations — verify out-of-band (callback, video, manager sign-off) before trusting the request.
• Tier collaboration-suite access. Slack/Confluence channels holding dev material or secrets need restricted membership, not blanket org-wide visibility.
• DLP for media and bulk download. 90 clips leaving a workspace is a detectable shape; volume-based egress alerts on collaboration platforms are table stakes post-2022.
• Session anomaly detection. New device + new geography + immediate media access from a contractor account is the exact signature to auto-challenge.
• Rehearse leak-response comms. Rockstar’s statement worked because it was fast, minimal, and confirmed only what was public; have the template ready.

Was source code actually taken?

The forum poster claimed to have downloaded source materials alongside the footage, and this claim circulated widely in early reporting. Rockstar’s official statement confirmed the network intrusion and the leak of development videos but did not confirm source exfiltration. Treat the source-code claim as unverified; the footage leak alone is the confirmed event.

How does this connect to the Uber breach?

Contemporaneous reporting and subsequent UK court documents linked both September 2022 intrusions to the same Lapsus$-affiliated teenager. The shared pattern: human-layer entry (bought or socially-engineered credentials, MFA-fatigue approval), then pivot through internal tooling and collaboration suites. Two different companies, same month, same adversary family, same defensive gap — which is why the pair is taught together.

Was the hacker convicted?

In related 2023–2024 UK proceedings, members of the Lapsus$ crew — teenagers at the time of the offenses — were found responsible for intrusions including Uber, Rockstar, and others, per court reporting. Because the principal was a minor at the time, the disposition emphasized hospital orders and supervision rather than standard adult sentencing, per contemporaneous coverage — keep the specifics hedged to “per court reporting” when citing.

Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.