{"meta":{"database":"Global Social Engineering Impact Database","url":"https://global-social-engineering-impact-da.vercel.app","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","generated":"2026-08-29T09:22:11.574Z","total":1,"returned":1,"limit":50,"offset":0,"next":null,"note":"Read loss_kind before summing loss_usd: only direct_loss and ransom_paid are comparable. Entries with entry_type \"benchmark\" are aggregate agency statistics and overlap with everything else by construction."},"results":[{"title":"Rockstar Games internal Slack breached and GTA 6 footage leaked","date":"2022-09-18","date_precision":"day","victim_org":"Rockstar Games","sector":"Gaming & Casino","country":"United States","primary_vector":"Help Desk Impersonation","secondary_vectors":[],"ai_involvement":"No AI reported","ai_notes":"No AI involvement reported.","outcomes":["Data Breach","Extortion"],"loss_usd":null,"loss_note":"Rockstar and parent Take-Two did not quantify losses publicly.","records_affected":null,"threat_actor":"Arion Kurtaj, linked to Lapsus$ (same actor as the Uber intrusion)","summary":"An actor using the handle teapotuberhacker, the same persona behind the Uber intrusion days earlier, posted roughly 90 in-development Grand Theft Auto VI videos and claimed to hold GTA V and GTA VI source code, saying they had reached Rockstar's internal Slack and Confluence. Rockstar confirmed a network intrusion and unauthorised access to early development footage. A UK teenager, Arion Kurtaj, was later convicted and in December 2023 given an indefinite hospital order.","how_it_worked":"The actor did not publish a technical exploit chain, and Rockstar has never described the entry point, so the mechanics are attacker-claimed and inferred from the same operator's behaviour at Uber days earlier: harvesting employee credentials and then talking a human into approving access, followed by collection from collaboration platforms rather than code repositories. Once inside Slack and Confluence the value was not code execution but corporate memory, build videos, design documents and chat, which the actor packaged directly into an extortion attempt and a public leak.","lessons":"Collaboration platforms hold the crown jewels for a media company and deserve the same phishing-resistant MFA, device trust and data-egress monitoring as source control.","confidence":"Alleged","sources":[{"title":"Alleged Grand Theft Auto 6 (GTA6) gameplay videos and source code leaked online","url":"https://securityaffairs.com/135923/data-breach/gta6-gameplay-videos-source-code-leak.html","publisher":"Security Affairs"},{"title":"London Police arrested a teen suspected to be behind Uber, Rockstar Games breaches","url":"https://securityaffairs.com/136146/cyber-crime/uber-rockstar-games-hacker-arrest.html","publisher":"Security Affairs"}],"entry_type":"incident","slug":"2022-rockstar-games-internal-slack-breached-and-gta-6-footage-leaked","year":2022,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2022-rockstar-games-internal-slack-breached-and-gta-6-footage-leaked"}]}