Original Coverage & Source Attribution: www.cybersecurity-insiders.com
Few entertainment releases generate the level of attention surrounding Grand Theft Auto VI. Every official reveal and every unauthorised leak can become a major online event. That makes pre-release information unusually valuable, whether it is gameplay footage, development material or details of a launch campaign.
We can see the scale of that interest on G2A.COM. When GTA VI pre-orders opened in June, traffic to GTA VI-related pages increased 65-fold compared with the earlier baseline. In a G2A.COM survey of nearly 1,500 users, two-thirds ranked GTA VI among their three most anticipated games of the year, while 56% said they expected to start playing within 24 hours of release.
For security teams, that level of attention matters. The value of information is not determined only by what a file contains, but also by what could happen if it becomes public before it is supposed to.
It is important, however, to distinguish what we know from what we do not. The major GTA VI leak in 2022 followed a confirmed intrusion into Rockstar Games systems. More recently, unauthorised GTA VI gameplay appeared online again in August 2026, prompting Take-Two to pursue information that could identify those responsible. The precise route through which that material was obtained has not been publicly established.
So the latest leaks should not be presented as proof of a supply-chain compromise. They do, however, highlight a wider security problem that affects almost every large digital project: valuable information rarely exists within a single security perimeter.
Modern games are developed and launched through complex ecosystems. Publishers may work with external studios, contractors, localisation specialists, technology providers, marketing agencies and distribution partners. Depending on their role and the stage of the project, some of those organisations may legitimately need access to confidential assets.
The same is true far beyond gaming. Software, financial services, e-commerce and other digital businesses increasingly depend on third parties to develop, operate and deliver their products. That means organisations need to understand not just their own security controls, but where sensitive information goes, who can access it and for how long.
Access should follow the lifecycle of a project. A partner may legitimately need particular material for several weeks or months, but that does not mean the same access should remain indefinitely. Permissions should be scoped to the minimum required information and reviewed when a project moves between phases.
This is one of the simplest ways to reduce unnecessary exposure. Temporary access should remain temporary.
The same principle applies to accounts. Dormant contractor accounts, excessive privileges and access that survives the end of a project all create risk without providing business value. Security teams should therefore connect identity and access management with real project milestones rather than relying only on periodic reviews.
Third-party security also needs to be defined before sensitive information is shared. Organisations should establish expectations for how confidential material is stored, transferred and deleted; how access is authenticated and logged; and how security incidents are reported and handled.
Those requirements should form part of the relationship with a supplier, rather than being discussed for the first time after an incident occurs.
Visibility is equally important. An organisation should be able to identify which external parties have access to its most sensitive assets and understand the dependencies between them. Without that view, detecting unusual behaviour, containing an incident and determining what may have been exposed becomes significantly harder.
Technology alone is not enough. People handling sensitive material need to understand why it is valuable and how to react when something does not look right. An unexpected request for a confidential file, an unusual authentication attempt or a request to bypass an established process should have a clear and rapid escalation path.
The aim is not to eliminate collaboration. Large digital products could not be developed without it. Nor is it realistic to claim that every leak can be prevented.
The objective is to reduce unnecessary exposure, make legitimate access as precise as possible and detect abnormal activity quickly enough to limit the consequences of a compromised account or system.
GTA VI is an unusually visible example because the audience waiting for the product is enormous. But the underlying lesson applies to almost every organisation developing valuable digital products.
Security cannot stop at the company network boundary. It has to follow sensitive information throughout its lifecycle: across systems, identities and organisations, wherever that information legitimately needs to go.
_____
About Adrian Podkaminer
Adrian Podkaminer is Chief Information Security Officer (CISO) at G2A.COM, the world’s largest marketplace for digital entertainment, trusted by more than 35 million users across 180 countries. He leads the company’s cybersecurity strategy, protecting a global platform that processes thousands of secure digital transactions every day and connects buyers with verified business sellers worldwide. With a background spanning software engineering, cloud security, and cybersecurity leadership, Adrian specializes in securing large-scale digital ecosystems and enabling the safe adoption of emerging technologies. Passionate about innovation, he is an early adopter of AI, cloud computing, and Kubernetes, and actively explores new technologies through his home lab and personal projects in software-defined radio (SDR) and wireless network security.
