About a week after its original Microsoft and Discord subpoenas, Take-Two returned to the Southern District of New York on August 28 with a second filing, this one narrower. Where the first was a broad data request across multiple accounts and server communities, the new one targets two users specifically: one who had already been identified in the earlier filing and one additional account whose identity the investigation has since produced. TorrentFreak, PC Gamer, and VGC reported the filing on August 31.
Take-Two asked the court to keep the new filing permanently sealed. The argument set out in the documents is that if it became public, the targets could learn the scope of what has been gathered against them and use that knowledge to delete evidence or take further steps to avoid identification. Judge Andrew L. Carter granted the request. Per PC Gamer, his order found 'good reason to issue an order directing the clerk to issue said subpoena' and said it would be issued 'as sought by the petitioner', which covers the sealing motion.
Separately, Take-Two also withdrew its subpoena against YouTube and Google, which had targeted three handles associated with the Cyberleek operation: CyberLeeks, Surfer24k, and CyberLeek_ar_io. Judge John P. Cronan had asked for more on how those accounts connected to the leaked footage. Take-Two supplied some additional detail, then withdrew the request anyway, telling the court it no longer needs that particular information and reserving the right to come back with a new one. The investigation is ongoing, with no formal identification of suspects made public.