There really was a user called "cyberleek" active on the German-language forum SzeneBox years before the current GTA VI leaks. The account was registered in 2017 and posted about web security, penetration testing, Linux/server administration, VPNs and related technical subjects. So this isn't something somebody invented yesterday.
The old account can also be linked surprisingly strongly to tech-forum.ch, a Swiss-domain technology forum. In January 2018, "cyberleek" actually said they had temporarily lost access to their ""tech-forum" account" on SzeneBox; the Tech-Forum account subsequently returned. The interests overlap too: servers, Linux, gaming, Raspberry Pi and 3D printing. So the old "cyberleek" / Tech-Forum connection is quite solid.
But one claim now spreading around Reddit is wrong: this was not a CyberLeek GitHub account from 2018. The GitHub repository people are talking about is a 2026 community investigation collecting the old evidence. The original material comes mostly from SzeneBox and related old accounts.
The “CyberLeek was doing SQL injection/pentesting in 2018” story has also been distorted. There is indeed a SzeneBox thread about exploiting an SQL-injection vulnerability — but it was started by another user in 2022. "cyberleek" replied in April 2023, basically saying: I'd like to join, let me know if there's room. The technical description of the SQL injection wasn't written by CyberLeek.
That doesn't make the old account irrelevant. The broader history still shows a persistent interest in WebSec. An apparent 2018 introduction lists “Web-Security/Penetration Testing” among the user's interests, and later posts involve VPNs, Cloudflare, server matters and breach-forum-related discussion. But the public record looks more like a technically inclined security hobbyist than proof of some elite hacker. In fact, in one 2018 post "cyberleek" explicitly calls himself an “absolute N00b” at JavaScript while asking for help with a hacking challenge.
The German/Swiss question is interesting too. The account wrote naturally in German and repeatedly used “Moin.” But “Moin = definitely northern German” is weak evidence. The stronger clue is the connection to tech-forum.ch and Swiss-style spellings such as “Grüsse.” That establishes a meaningful Swiss connection, although it still doesn't prove nationality or residence.
The current investigation also points to CyberLeek using Hetzner infrastructure in Germany. That tells us where a server is hosted, not where its operator lives. Treating “German server = German leaker” as identification evidence is extremely weak.
The biggest problem with the current theory is the supposed matching profile picture. The research convincingly links the same flaming-skull avatar across the old CyberLeek/Tech-Forum identities. What I haven't found is equally solid evidence showing that the genuine 2026 GTA VI CyberLeek used that same avatar. That distinction seems to have disappeared as the story spread.
So there are really two different propositions:
Old CyberLeek = old Tech-Forum operator: strongly supported.
Old CyberLeek = the person behind the 2026 GTA VI leaks: interesting, plausible, but currently unproven.
The exact alias is unusual, and the old person's security/server interests make the coincidence genuinely worth investigating. But the present case is still circumstantial. Same pseudonym + compatible interests + German-speaking background is not the same thing as demonstrated continuity of identity.
There are also obvious alternatives: the modern leaker independently chose the name, borrowed an obscure old hacker-style identity, is part of a group, or deliberately left misleading attribution clues. We also shouldn't assume CyberLeek is necessarily one man; the public evidence doesn't establish that.
This is how I think the Reddit story mutated:
“Researchers on GitHub found an old German-speaking CyberLeek interested in pentesting”
became
“CyberLeek had a GitHub account doing penetration testing in 2018.”
And:
“The same avatar links several old CyberLeek accounts”
became
“The GTA leaker has the same avatar as the 2018 account.”
Then:
German posts + Swiss forum + German-hosted server
became
“They found him, he's German/Swiss and he's going to stop leaking.”
That final leap is not supported. There is currently no public evidence that CyberLeek has been arrested, identified by Rockstar/law enforcement, or shut down.
The genuinely significant discovery is narrower and more interesting: someone was using the name "cyberleek" in a German-speaking web-security/technology scene as far back as 2017, and that person left a multi-year technical footprint.
If somebody can establish authenticated continuity between one of those old accounts/assets and the present leak operation, then this becomes a serious attribution breakthrough. Until then, it's a very good lead being turned into a solved case by internet telephone.
Source: r/PhysicalMediaMatters · by /u/Odd_Pack2255