Over a single weekend in September 2022, roughly ninety video clips of the next Grand Theft Auto, appeared on a fan message board called GTAForums. They were posted in the early hours of the eighteenth, UK time, by someone who claimed to have been inside Rockstar Games’ own systems. Take-Two, Rockstar’s parent company, had the posts taken down, but the material had already spread across social media and news sites.
On the nineteenth, Rockstar confirmed it. An unauthorized third party, the company said, had illegally accessed and downloaded confidential information from its systems, including early development footage for the next Grand Theft Auto. Rockstar said it did not anticipate any disruption to its live game services, nor any long-term effect on the development of its ongoing projects. The same day, Take-Two noted the intrusion in a filing to the SEC.
Take-Two’s next quarterly filing put a figure on the damage in its own words. This intrusion, together with a separate incident at another of its labels, had brought “immaterial incremental one-time costs,” for consultants, experts and data recovery. The company took in more than five billion US dollars in revenue in the financial year that included the breach, so a real cost could still be immaterial against a number that size. The same filing said security breaches, including this one, had negatively affected its operations and financial results.
The footage was the loss people saw. The more serious one, by the accounts published since, was source code. Rockstar’s statement named only confidential information and footage. According to The Record, the forum post that carried the clips also attached source code as evidence. The Cyber Safety Review Board, the federal panel that later reviewed a string of attacks on major companies, records in its 2023 report the theft and publication of source code for two flagship games from a gaming company, and that entry cites the forum post itself. Footage shows what a game will look like; source code is the working machinery a studio builds the game from. No primary account indicates that any Rockstar player’s names, passwords or payment details were exposed.
Rockstar has never said publicly how the intruder got in. Uber has explained its own case. It disclosed a breach on the evening of Thursday the fifteenth of September, US time, about two days before the clips appeared, and by Uber’s account it began with a contractor’s corporate password, which Uber believes the attacker likely bought on the dark web after malware on the contractor’s personal device had exposed it. The attacker tried again and again to log in, and each attempt sent a two-factor login approval request asking the account’s owner to confirm the sign-in. At first those requests blocked access. Eventually one was accepted. From there the attacker reached several other employee accounts and, through them, elevated permissions to tools including G-Suite and Slack. At no point in Uber’s account did the attacker need a flaw in Uber’s software.
On the nineteenth, Uber said it believed its attacker or attackers were affiliated with a group called Lapsus$, and it passed on a report rather than confirming one of its own: “There are also reports over the weekend that this same actor breached video game maker Rockstar Games.” Rockstar and Take-Two, in their own statements and filings, have only ever called their intruder an unauthorized third party. What the poster said is a claim the poster made, including, according to the Guardian, that the footage came from Rockstar’s internal Slack. None of the poster’s claims has been confirmed by Rockstar or Take-Two in their own statements or filings.
The group Uber named, Lapsus$, was small, and had been going after major companies since late 2021; by Uber’s own count it had breached Microsoft, Samsung, Nvidia and Okta in 2022 alone. The board received no evidence of nation-state ties. It found the group used low-cost techniques, writing that the groups it studied relied on “relatively non-complex techniques like social engineering and bypassing weaker forms of multifactor authentication.” Researchers observed no use of zero-day flaws during the study. Across the attacks it studied, the board found credentials stored where teams share information, such as access keys in Slack and administrator passwords documented in a spreadsheet. It wrote that organizations lost control of “crown jewel” intellectual property and consumer data, and across those attacks the route to them often ran through a team’s chat and wiki.
Two fixes follow from that. First, where the route runs through a team’s chat and wiki, treat those collaboration tools the way you would treat production systems: gate who can reach them, and watch what happens inside them, because they hold the credentials and keys that open other systems. Second, harden the human front door, with identity checks at the help desk that a smooth phone call cannot talk past, and a second factor that does not fold when someone is flooded with requests. The board’s findings had reach beyond the report: in its review of 2023 it wrote that the September 2023 attacks on Caesars and MGM, which “leveraged similar techniques,” reinforced their timeliness, and when the US Federal Communications Commission adopted rules against SIM-swap attacks that November, its chair noted the board’s recommendation.
For one person at one desk, the advice is shorter. A login approval request you didn’t start most likely means someone already has your password. Deny it, and tell whoever runs your IT.
This account reflects the public record as it stood on the twenty-fifth of September 2026. Has your team found a good way to keep shared passwords and keys out of its chat and wiki? We would like to hear how.
**Sources & further reading:**
- Rockstar Games: statement on the network intrusion (19 September 2022)
- Take-Two Interactive: SEC filings, including the filing of 19 September 2022 and the next quarterly report
- Uber: security update on its September 2022 incident
- Cyber Safety Review Board: review of the attacks associated with Lapsus$ and related groups (2023), and its 2023 year in review
- US Federal Communications Commission: rules against SIM-swap attacks (November 2023)
- Reporting by The Record and the Guardian