cyberleek
ransomware group · aka Cyberleak, teapotuberhacker (forum persona linked to the widely reported 2022 GTA 6 leak) · unknown; press and court reporting link the group's best-known activity, the 2022 GTA 6 leak, to a UK-based individual (Arion Kurtaj), with reported ties to Lapsus$ · active since 2026-08-24 (per this dashboard's leak-site tracking); widely reported precursor activity in September 2022 is linked by public reporting to the same actor persona
Victims · 7d
0flat
Victims · 30d
12active targets
Victims · 90d
12
All-time (tracked)
12since 2026-08-24
Last post
08-24 15:23UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Cyberleek is a low-volume data-leak/extortion group on this dashboard, with 12 listed victims as of 2026-08-24 and no victims posted in the past 7 days. Its most widely reported public activity is the September 2022 leak of in-development Grand Theft Auto VI footage from Rockstar Games, published by the forum persona 'teapotuberhacker' and confirmed authentic by Rockstar. Subsequent press and court reporting linked that intrusion to UK teenager Arion Kurtaj, associated with Lapsus$ and convicted in 2023 for the Rockstar breach; the same actor was publicly linked to the claimed 2022 Uber breach. No branded ransomware payload or publicly documented ransom demand is known, so the group's extortion model and victim-selection pattern remain unclear. Given the minimal posting volume observed here (12 victims in 90 days), the group's current operational scale is unknown.
Tactics & tooling
- Data-theft extortion: exfiltrates proprietary material and publishes excerpts on a leak site
- Uses anonymous forum personas for publication and negotiation rather than a branded ransomware operation
- Releases many small individual media samples rather than a single archive, maximizing publicity pressure
- Targets high-profile technology and gaming companies for reputational leverage
- Reported use of compromised credentials and social engineering to access corporate networks (per Lapsus$-linked reporting)
- Exfiltration of large volumes of unreleased media, builds, and source material from development environments
Targeted sectors
Gaming/EntertainmentTechnologySoftware development
Notable public victims
Rockstar Games / Take-Two Interactive - in-development Grand Theft Auto VI footage leaked September 2022 (widely reported; Rockstar confirmed the leak was authentic), GTA 6 development clip listings (e.g., 'Nudist Town', 'Map Sneak Peek 1/2', 'Plane') as shown on this dashboard
Estimated earnings
No public figure.
Leak-site victims12 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| GTA 6: Nudist Town (Strong Nudity) | · 22d ago | — |
| GTA 6: Map Sneak Peek 1 | · 22d ago | — |
| GTA 6: Map Sneak Peek 2 | · 22d ago | — |
| GTA 6: Basketball Video | · 22d ago | — |
| GTA 6: Full Map | · 22d ago | — |
| GTA 6: Taser Video | · 22d ago | — |
| GTA 6: Hypercar Video | · 22d ago | — |
| GTA 6: Plane Video | · 22d ago | — |
| GTA 6: Junkie Video | · 22d ago | — |
| Strip Club | · 22d ago | — |
| GTA 6: Gas | · 22d ago | — |
| GTA 6: Plane (Night) | · 22d ago | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .