What the GTA 6 Subpoenas Actually Demand, and Who Gets Swept In

The four subpoenas Take-Two obtained in the GTA 6 leak investigation do not ask for the identity of three or four people. Read at the level of Attachment A, which is the schedule that actually defines the scope, they ask Discord for identifying information on every account that has been a member of three named servers at any point since 1 June 2026, and they ask Microsoft for the contents of some users' OneDrive storage. We have now read Attachment A in all four matters, from documents already sitting free in the public archive. One of the three Discord servers is, in Take-Two's own description, the editors' server of a well known Australian streamer, which has no alleged connection to anything beyond an overlap in membership. This piece sets out what is demanded, who falls inside it, and the several places where we cannot tell you what has happened next. What do the GTA 6 subpoenas actually demand? CONFIRMED, from the extracted text of documents already in the free archive. No PACER documents were purchased. In 1:26-mc-00422, the Discord matter, Doc 1-1 page 5, filed 20 August 2026, fetched at HTTP 200, 68,249 bytes, Attachment A names three Discord handles and then demands, verbatim: All identifying information associated with all user accounts that are/were members of the Discord community servers and channels listed below during the time period from June 1, 2026 to present. For each returned account, provide the following: backend server metadata or telemetry records, original message logs, IP access logs, email addresses, phone numbers, connected accounts, registration timestamps, linked connections (Google/Xbox/etc.), and any associated device identifiers (MachineGuid/MSA). Take the first sentence slowly. The unit of the demand is a server rather than a suspect. Every account that has been a member of the listed servers since 1 June 2026 falls inside it, and for each of those accounts the list that follows asks for message logs, IP access logs, phone numbers, linked Google and Xbox accounts, and hardware identifiers. Whose servers are they? Three, listed by numeric guild ID and in some cases by invite link. Every one of those identifiers is [REDACTED BY 6CHARTS] and appears nowhere on this page. We redact them for a specific reason. A court filing is a public record and its contents are fair to report. Reprinting the machine-readable identifiers inside it publishes a working route to communities whose members are, on the face of these documents, mostly bystanders. Describing the three servers by category tells you everything you need in order to judge how broad the demand is. CONFIRMED, using Take-Two's own descriptions from the filing. The three are a cheat community described as the operator's home, a public brand guild, and the editors' server of a well known Australian GTA V streamer. We are not naming that streamer, and the withholding is deliberate. His server is swept into the demand with no alleged connection to the leak beyond an overlap in membership, he is not accused of anything in the filing, and no court has found any person liable in any of these matters. Naming him would attach a man to an investigation in the one place search engines will find it, on the strength of his Discord server appearing in a list. He has REPORTEDly denied involvement publicly. Every image on this page is official Rockstar material. Nothing on this page comes from leaked material, and we did not view any. What does the Microsoft subpoena ask for? The same membership sweep, plus the contents of private cloud storage. CONFIRMED, 1:26-mc-00421, Doc 1-1 page 5, HTTP 200 at 68,791 bytes. It first demands, verbatim, with the persona name redacted by us: All internal Microsoft business records and investigative records associated with Microsoft's internal investigation of the [REDACTED BY 6CHARTS] persona sufficient to identify the user(s), person(s) and/or entity/ies associated with that persona It then reaches accounts that communicated with the same three Discord servers since 1 June 2026, and asks for, verbatim: the account ID, registration email, registration and last-login IP addresses, phone number, linked connections (Google/Xbox/etc.), any associated device identifiers (MachineGuid/MSA), and content related to Grand Theft Auto ("GTA"), Rockstar or [REDACTED BY 6CHARTS] from their OneDrive account What are the three questions worth asking about that? These are questions and not accusations. We raise them because they are visible on the face of a public filing and nobody appears to have raised them. First, the filing makes a factual claim about Microsoft. It asserts that Microsoft has run an internal investigation of the persona. That is the applicant's assertion, on a public record, about a third party. We could not independently verify it and Microsoft has said nothing about it that we can find. Second, the live legal question. Section 512(h) authorises a subpoena for information "sufficient to identify the alleged infringer". That is the statutory limit. A demand for the contents of a OneDrive account, or for original message logs, seeks content rather than subscriber-identifying information. Whether that falls inside 512(h) is a question a court could be asked, and on the public record nobody has asked it in any of these four matters. Third, a drafting detail. The Microsoft attachment contains an unfinished field: one of the three servers is listed with its guild ID given as "TBD by partner". The subpoena issued anyway, reaching every member of a server whose identifier was still a placeholder. What do the X and Google subpoenas cover? The same window, the same categories, different platforms. CONFIRMED, 1:26-mc-00426, X Corp., Doc 1-1, HTTP 200 at 67,560 bytes: three named X usernames, all [REDACTED BY 6CHARTS], the same 1 June 2026 to present window, and the same category list. Return date 8 September 2026 at 10:00 am. CONFIRMED, 1:26-mc-00425, Google, for YouTube, Doc 1-1, HTTP 200 at 67,905 bytes: one video identified by URL and video ID, and three YouTube personas identified by channel URL, all [REDACTED BY 6CHARTS], same window, same categories. Return date 8 September 2026 at 10:00 am, a date drafted before Judge John P. Cronan declined to authorise issuance and required Take-Two to supplement its application. What is a section 512(h) subpoena? A clerk-issued process, built to be fast, that skips the ordinary step of suing somebody first. In a normal civil case you file a lawsuit, the other side appears, and discovery follows under judicial supervision. Section 512(h) lets a copyright owner go to the clerk of a federal court, file a sworn declaration stating that the purpose of the subpoena is to obtain the identity of an alleged infringer, and have a subpoena issued to a service provider. There is no defendant, no complaint and no trial. These applications are also heard ex parte, which means one side only. CONFIRMED: the orders in 421 and 422 were signed the day after filing with nobody present to argue against them, because at that stage there is no other side. The people whose data is demanded are not notified and have no opportunity to object before the subpoena issues. That is how the statute was designed, and rights holders are entitled to use it. It does mean the scope of a demand goes unchallenged unless the recipient provider pushes back, which brings us to the thing we cannot tell you. Where do the four matters stand? CONFIRMED, docket state. CaseRecipientJudgeFiledStatusReturn date 1:26-mc-00421MicrosoftJennifer L. Rochon20 Aug 2026terminated 21 Aug, order granting 21 Aug4 Sep 2026, 10:00 am 1:26-mc-00422DiscordAndrew L. Carter Jr.20 Aug 2026terminated 21 Aug, order granting 21 Aug4 Sep 2026, 10:00 am 1:26-mc-00425Google, for YouTubeJohn P. Cronan21 Aug 2026open, memo endorsement demanding a supplement8 Sep 2026 as drafted 1:26-mc-00426X Corp.Analisa Torres21 Aug 2026open, order granting8 Sep 2026, 10:00 am CONFIRMED against the AO 88B forms: the 4 September return dates in 421 and 422 are real, and the place of production is Kirkland & Ellis, 601 Lexington Avenue. That is seven days from publication. CONFIRMED, the counsel split: 421 and 422 were filed by Dale M. Cendali of Kirkland & Ellis, with the subpoenas issued by Joshua L. Simmons of the same firm. 425 and 426 were filed by Rachel M. Bandli of a different intellectual property boutique. We withhold the email address printed on the forms. The cause of action on all four is "M 08-86 Internet Infringement", the filing fee is $52.00 each, and all four Rule 7.1 statements identify BlackRock, Inc. as an "Other Affiliate" of Take-Two. REPORTED, corroborated by us on the date only. Malwarebytes, in a piece by Danny Bradbury dated 25 August 2026 which we fetched at HTTP 200, 326,058 bytes, wrote: "Microsoft and Discord have until September 4 to hand over the data. If they comply, potentially hundreds or thousands of people with no known connection to the leaks could have identifying information handed over to Take-Two as part of its investigation." The estimate of how many people is Malwarebytes' and we have no way to size it. Has anything happened since Judge Cronan's order? Nothing that we can see, in the window we can see, and the second half of that sentence is doing real work. CONFIRMED NEGATIVE. We pulled the Southern District of New York's live ECF feed three times. FetchedResultFeed builtItemsCoverage 02:59:08ZHTTP 200, 1,119,639 bytesFri 28 Aug 2026 01:05:03 GMT2,44527 Aug 01:06:20 to 28 Aug 01:03:45 GMT 03:08:30ZHTTP 200, 1,136,901 bytes28 Aug 03:05:03 GMT2,48127 Aug 03:09:10 to 28 Aug 02:57:03 GMT 03:13:16Zbyte-identical to the secondunchanged2,481unchanged Overlapping the first two windows gives continuous coverage from 27 August 01:06 UTC to 28 August 02:57 UTC. Across 2,481 items there are zero hits on any of the four case numbers and zero occurrences of "Take-Two". The feed's own description enumerates the entry types it carries, motion, order, misc, misccs and notice among them, so a supplement, a motion to quash or a new order would all fall inside what it publishes. So, as of 28 August 2026 at 02:57 UTC: Take-Two has not supplemented its application in 1:26-mc-00425 on the visible record, four days after Judge Cronan ordered it to do so promptly. No motion to quash has been filed by anyone in any of the four matters. No fifth Take-Two matter exists. And here is the gap, printed because leaving it out would make the paragraph above a stronger claim than we can support. CourtListener's own crawl of 425 and 426 last ran on 25 August 2026 at 1:59 p.m., and the court's live feed reaches back only to 27 August at 01:06 UTC. The window from roughly 25 August 14:00 UTC to 27 August 01:06 UTC is covered by neither source, and we cannot rule out a filing in that roughly 35 hour hole. So we are not writing that nothing has happened since Judge Cronan's order. We are writing that we found nothing on the public record in the window we can actually see. Compliance status is UNKNOWN. Nothing on any docket says whether Microsoft, Discord or X has produced, objected or negotiated. Production under section 512(h) goes to the requesting party rather than to the court, so it may never appear on a docket. Silence on the record is not evidence that nothing is happening. What is the other SDNY DMCA matter? One worth watching, and one we are refusing to characterise. CONFIRMED via the SDNY RSS feed: SDNY 1:26-mc-00368, captioned "In Re: REQUEST FOR ISSUANCE OF DMCA SUBPOENAS PURSUANT TO 17 U.S.C. 512(h)", before Judge Jesse M. Furman, filed 20 July 2026, with a declarant named Erich S. Lima who is not Take-Two counsel. On 27 August 2026 at 21:13:28 GMT that docket recorded a Memorandum and Opinion, document 7, and at 21:18:11 GMT an AO 121 case-terminated form. We have not read the opinion. We know it exists and when it was entered, and we do not know what it says. If it construes the scope of section 512(h) in this district it lands a week before Take-Two's return dates. If it does not, it is unrelated housekeeping. We flag it as something to watch, and anybody telling you today what it means for the GTA 6 subpoenas has not read it either. What is and is not established Confirmed, HTTP 200 at 68,249 bytes, from documents already free in the public archive: Attachment A in 1:26-mc-00422 demands identifying information for every account that has been a member of three listed Discord servers since 1 June 2026, with message logs, IP access logs, phone numbers, linked Google and Xbox connections and device identifiers. Quoted verbatim above. Confirmed, using Take-Two's own descriptions: the three servers are a cheat community described as the operator's home, a public brand guild, and the editors' server of a well known Australian GTA V streamer, the last with no alleged connection beyond membership overlap. Editorial policy: we do not name that streamer, who has reportedly denied involvement, and we redact every handle, guild ID, invite link, username, channel URL, video URL and video ID. No court has found any person liable and the material is described here as allegedly infringing. Confirmed, HTTP 200 at 68,791 bytes: 1:26-mc-00421 demands Microsoft's internal investigative records on a persona, plus account IDs, registration email, registration and last-login IPs, phone numbers, linked connections, device identifiers and OneDrive content for accounts communicating with the same three servers since 1 June 2026. Raised as questions, not accusations: the application asserts that Microsoft has run an internal investigation of the persona, which we could not independently verify; and whether OneDrive contents and message logs fall inside 512(h), which reaches only information sufficient to identify an alleged infringer, has not been tested in any of these four matters. Confirmed drafting defect: the Microsoft attachment lists one server's guild ID as "TBD by partner", and the subpoena issued on it. Confirmed, HTTP 200 at 67,560 and 67,905 bytes: the X Corp. matter names three usernames and the Google matter one video and three YouTube personas, both over the same window with the same categories and an 8 September 2026 return date as drafted. Confirmed against the AO 88B forms: 421 and 422 are returnable 4 September 2026 at 10:00 am, place of production Kirkland & Ellis, 601 Lexington Avenue. Both orders were signed the day after filing, ex parte, with no notice to the people whose data is demanded. Confirmed: 421 and 422 were filed by Dale M. Cendali of Kirkland & Ellis with subpoenas issued by Joshua L. Simmons, and 425 and 426 by Rachel M. Bandli of a different boutique. Cause of action "M 08-86 Internet Infringement", filing fee $52.00 each, and all four Rule 7.1 statements name BlackRock, Inc. as an Other Affiliate of Take-Two. Confirmed negative, three feed pulls at 02:59:08Z, 03:08:30Z and 03:13:16Z, continuous coverage 27 Aug 01:06 UTC to 28 Aug 02:57 UTC: zero hits on any of the four case numbers and zero occurrences of Take-Two across 2,481 items. Not claimed, and the gap stated: we do not say nothing has happened since Judge Cronan's order. CourtListener last crawled 425 and 426 on 25 August at 1:59 p.m. and the live feed starts at 27 August 01:06 UTC, leaving roughly 35 hours neither source covers. Unknown: whether Microsoft, Discord or X has produced, objected or negotiated. Section 512(h) production is not filed with the court and may never appear on a docket. Confirmed as existing, not characterised: a Memorandum and Opinion and an AO 121 case-terminated form entered on 27 August 2026 in SDNY 1:26-mc-00368 before Judge Jesse M. Furman. We have not read the opinion. Reported, corroborated only on the date: Malwarebytes' estimate that potentially hundreds or thousands of people with no known connection to the leaks could have identifying information handed over. We confirmed the 4 September deadline ourselves and cannot size the population. We re-pull all four dockets daily and anything that reaches the public record goes on our news page. If you would rather spend the wait somewhere more entertaining, our servers list is the place to start.