Take-Two's GTA 6 leak subpoena turns Discord and Microsoft logs into a device-level ID list

MachineGuid is the item on that list that does the work. It is the value identifying a single Windows installation, and a Microsoft account device ID identifies the devices that access Microsoft services ^[3]. Alone, neither names anybody. Joined against phone numbers, IP addresses, linked Google and Xbox accounts and the contents of a OneDrive ^[2], they turn a Discord handle into a particular machine, and that machine into the other accounts that have touched it.

The window deserves as much attention as the field list. Records are sought from June 1 ^[1], and the first CyberLeek footage appeared on August 17 ^[7]. That is 77 days of history before anything was published, and roughly 80 days by the date of the subpoena ^[13][12]. An August leak is being investigated through logs that predate it by about two and a half months, which is a plain statement of what a retention setting is: whatever a platform still holds is the scope of somebody else's demand.

Take-Two has been on the wrong end of the same arithmetic. In April, the ShinyHunters crew took 78.6 million Rockstar records without compromising Rockstar's own systems, by going after Anodot, a cloud analytics vendor holding persistent authentication tokens for its customers' Snowflake environments ^[9]. The lesson of that incident was that the aggregate held by a third party is the thing worth stealing. This subpoena asks two third parties to build a fresh aggregate of other people's identifiers and hand it to a private litigant.

Microsoft and Discord have fifteen days from the subpoena to the deadline ^[14], which is not much room to argue about scope, and the Malwarebytes report records no response from either company and no statement that either will contest it ^[15]. Meanwhile the motive question stays open: commentators read the $CYBERLEEK token on Solana as a pump, and although the holding was burned on Sunday, trading fees reportedly reached $60,000 last week ^[8]. None of that narrows the request by a single account.

For anyone operating a community platform, the useful read is not the celebrity of the game. It is that a device fingerprint retained for abuse prevention doubles as an identity resolver the moment a subpoena arrives, and that server membership is being used as the selector, which is why the estimate of who gets caught runs to hundreds or thousands ^[5]. Matthew Judge, the Australian streamer whose server is named, says he had nothing to do with it and knew nothing about it ^[6], and his position is the position of most people in scope: identified to a corporate investigation because of where they hung out in June. The same footage is also being used as bait, with Malwarebytes finding fake "Extended Look" and demo sites that deliver password-stealing malware ^[11]. One leak, two separate ways for uninvolved members to lose control of their identifiers.