Grand Theft Auto VI is more than a major game release and for CISOs, the leaks surrounding its development are a reminder of a broader reality: some of an organisation’s most valuable assets may pass beyond its traditional perimeter.
It is important to distinguish what is known from what is not. The major GTA VI leak in 2022 followed a confirmed intrusion into Rockstar Games systems. Unauthorised gameplay also appeared online in August 2026, but the precise route by which that material was obtained has not been publicly established. Neither event should be presented as evidence that a supplier was compromised; instead, they provide a useful starting point for considering how organisations protect sensitive assets wherever authorised copies and access may exist.
At G2A.COM, we have seen the scale of interest surrounding the game. Visits to GTA VI offer pages increased significantly after Grand Theft Auto VI: An Extended Look premiered on Netflix, while traffic rose 65-fold against an earlier baseline when Rockstar Games opened pre-orders in June. These figures describe activity on G2A.COM; they do not measure the probability, cause or financial impact of a security incident.
These spikes show how quickly public attention can increase the commercial significance of an asset. The greater the interest around a release, the greater the potential consequences if sensitive information appears before its intended moment. That applies to unreleased promotional or gameplay material, but also to source code, commercial plans, acquisition documents, commercial negotiations and forthcoming announcements.
The lesson for security leaders is that third-party security can no longer be treated mainly as a procurement exercise. If it begins and ends with onboarding checks, contractual clauses and an annual questionnaire, it is based on an outdated view of how risk moves through a business.
The security perimeter extends across partner relationships.
Major games are rarely developed and launched by one organisation alone. Publishers work with external studios, localisation teams, marketing agencies, cloud providers, technology vendors and distribution partners long before a title reaches players.
The same model applies across modern business. Organisations rely on specialist partners to host infrastructure, analyse data, create products, operate services and reach customers. These relationships bring speed, expertise and scale, but they also create more routes through which sensitive information can travel.
A valuable asset may pass through several companies, systems, accounts and teams before becoming public. An organisation can protect its own network well and remain exposed through a supplier that holds the same information, connects to a shared platform or retains credentials linked to its environment.
This creates an important security asymmetry. An organisation may invest heavily in its own defences while the same asset remains accessible through a supplier, contractor or connected account with different controls.
For CISOs, the question is no longer simply whether their own systems are secure. They also need sufficient visibility to account for critical assets across the organisations and environments that legitimately handle them.
Follow the asset, not the organisation chart
An unreleased trailer illustrates the challenge. It may begin with an internal creative team before moving to an agency, localisation partner, media platform and distribution provider. Each transfer may be legitimate, but each introduces new people, systems and working practices. This is an illustrative scenario, not a finding about how any GTA VI material was obtained.
The answer is not to distrust every partner. It is to follow the asset throughout that journey.
Security leaders need a current view of where their most important information is stored, who can reach it, how it is transferred and who remains accountable at each stage. Without that visibility, identifying unusual activity or containing an incident becomes much harder.
This should be an ongoing process, not a map created once and forgotten. Projects change, suppliers take on new responsibilities and information moves between platforms. Third-party security therefore needs to be reviewed when a partner’s role expands, sensitive material leaves direct control, or a project reaches a significant milestone.
If a CISO cannot quickly establish who holds an asset and when access was last reviewed, the organisation is unlikely to respond confidently when something goes wrong.
Give access an expiry date
The wider lesson for third-party security is simple: access should last only as long as its purpose.
Different partners need different information at different stages. A localisation team may require selected game content, while a marketing agency needs footage or artwork ahead of a campaign. Those permissions may be appropriate when granted.
Risk grows when legitimate access remains open after the need has disappeared. This does not require a malicious outsider. It can begin with the right person retaining the wrong level of access at the wrong time.
A stronger approach connects permissions to purpose, responsibility and duration. Campaign launches, project milestones, contract changes and staff departures should prompt a review. When a supplier’s role changes, its access should change with it.
This is not about adding bureaucracy or slowing collaboration. It is about making sure access reflects how the relationship works today, rather than how it worked when the contract began.
Assess the consequence, not only the file
The attention surrounding GTA VI illustrates why technical classification alone is not always enough to determine an asset’s risk.
A short clip, image or release detail may not contain personal data or source code, yet its premature disclosure can disrupt a launch and create significant commercial or reputational consequences.
The same is true beyond gaming. A product roadmap, strategic partnership or acquisition plan may appear less sensitive than a customer database when assessed by data type alone. In practice, exposure at the wrong moment could weaken negotiations, affect markets or damage trust.
Timing, exclusivity and audience can make an ordinary-looking file exceptionally valuable. Security leaders should therefore consider what disclosure would do, not only what the asset contains. The protection applied should reflect its potential business impact as well as its regulatory sensitivity.
Build for resilience
No CISO can guarantee that information will never leak. Large digital projects involve too many people, systems and legitimate exchanges for absolute prevention to be realistic.
The stronger objective is resilience: reducing unnecessary exposure, identifying suspicious activity early and limiting the consequences if a supplier, account, system or process is compromised.
The GTA VI disclosures are a reminder that valuable information can exist across multiple security boundaries, but the confirmed intrusion into Rockstar Games systems in 2022 and the broader risks associated with authorised copies and access across an ecosystem are distinct matters. An organisation may own an asset without controlling every environment through which it legitimately moves.
The answer is not to retreat from partnerships. Collaboration drives modern product development, customer experience and growth. However, security needs to be built into how that collaboration operates.
The corporate perimeter may have moved, but the CISO’s responsibility to establish proportionate governance, visibility and assurance across critical third-party dependencies remains. Leaders who understand where their most valuable assets travel, who can access them and when that access should end will be better prepared to manage risk across an increasingly connected ecosystem.
By Adrian Podkaminer, Chief Information Security Officer (CISO) at G2A.COM.
- Cybersecurity