A Firestick, a Hotel TV, and a GTA 6 Leak: How Game Studios Really Get Breached

Ask most people to picture a studio getting hacked and they imagine something cinematic. The reality is stranger, cheaper, and much more instructive.

The hotel room

In September 2022, Rockstar suffered the largest leak in its history: around 90 clips of early GTA 6 development footage, posted publicly.

The person found responsible was Arion Kurtaj, a teenager linked to the Lapsus$ group. He was already on bail for an earlier intrusion, and his laptop had been confiscated. He was staying at a Travelodge under police supervision.

He got in anyway, using a hotel television, an Amazon Firestick, and a mobile phone.

Once inside, he reached Rockstar's internal Slack and posted a message giving the company 24 hours to contact him before he began releasing source code.

The tools cost less than a night in the hotel. The access came from people, not from equipment.

Kurtaj was later given an indefinite hospital order by a UK court, and reporting this year indicates he has since been moved to prison awaiting retrial.

The pattern underneath

Strip away the details and the same shape appears across nearly every major games industry breach:

• Someone is persuaded, not out-coded. Phishing and social engineering do the opening work.
• One account becomes many. Internal chat tools are a map of the whole company, and Slack is where builds, credentials and plans get shared casually.
• The weak door is often a side door. Rockstar confirmed in April this year that company information was accessed through a third party breach, and said it had no impact on the organization or its players. Vendors, contractors and outsourcing partners all hold real access.
• Ransomware crews now target studios directly. The 2023 Insomniac breach ended with roughly 1.6 terabytes of internal files published after a ransom deadline passed.

What this says about the August leaks

The current GTA 6 clips have not been traced to any confirmed method. Plenty of accounts are circulating, and none of them are established fact.

What is visible is that the footage appears to come from a genuine build, which means it came from somewhere inside the pipeline that produces builds. That pipeline runs through people, machines, and outside partners, and every one of those is a door.

The uncomfortable takeaway

Studios tend to invest in protecting the shipped game, because piracy is the threat everyone understands. The 2022 Rockstar incident, the Insomniac breach and this month's leaks all came from the other direction: the unfinished work, sitting on internal systems, reachable by ordinary accounts.

Firewalls did not fail in these stories. Trust did.

How we handle client work

At Vectra Play we build games under NDA, with project access limited to the people actually on the team, credentials kept off shared channels, and the finished source and assets delivered to you with full ownership. Tell us about your project and we will explain exactly who can see what, and when.