Epic nabs Fortnite leaker, seals deal | Analysis by Brian Moineau

TL;DR

  • Epic settled with ex-contractor Hayden Cohen over Fortnite leaks: a proposed court injunction would permanently bar Cohen from handling Epic Games’ confidential info, with no monetary relief disclosed—deterrence now runs through the Defend Trade Secrets Act (DTSA), not damages [1][2][4].
  • The core risk wasn’t a few skins; it was partner trust—brands like South Park, Minecraft (Mojang/Microsoft), and Overwatch (Blizzard) don’t tolerate surprise-killing leaks that derail synchronized co-marketing plans [1].
  • An injunction-first deal can be smarter than a damages fight: it avoids discovery that could surface partner decks and drafts, while creating a personal tripwire for any future breach under 18 U.S.C. § 1836 [2][4].

What the source said

Video Games Chronicle reported that Epic Games reached a settlement with Hayden Cohen, a former associate producer accused in March 2026 of leaking upcoming collaborations—South Park, Minecraft, and Overwatch—via an X account that gained roughly 13,000 followers before deletion [1]. The deal seeks a stipulated court injunction barring Cohen from possessing, accessing, using, or disclosing Epic’s confidential or trade secret information [1]. PC Gamer corroborated that the filing mentions no monetary relief, and Epic declined to comment on damages [2]. Epic spokesperson Natalie Munoz said the company sought the injunction “to ensure [Cohen] cannot publish or share Epic’s confidential information again” [1].

Why it matters

Three constituencies are on the line. First, Epic’s live-service cadence: Fortnite relies on tightly timed “surprise” drops that lift Item Shop conversions and engagement each season; a reliable insider leak collapses that timing [1]. Second, IP partners like Mojang/Microsoft (Minecraft), Blizzard (Overwatch), and South Park’s rights holders budget around synchronized beats; early spoilers blunt conversion and trigger contractual friction [1]. Third, the creator economy orbiting Fortnite—Support-A-Creator affiliates, Twitch streamers, and YouTube channels—plans sponsor slots and programming around reveal windows.

The settlement also draws a bright line between datamining and insider misappropriation. Datamining scrapes assets already in public builds; insider leaks extract pre-build plans and partner decks. Under the DTSA, federal courts can tailor injunctions to halt threatened misappropriation, which is exactly what Epic is asking the court to endorse here [4].

Original analysis

The consensus—and why it’s wrong

  • Consensus: “No damages? Then the Fortnite leaker settlement is a slap on the wrist.”
  • Contrarian read: a permanent injunction is the sharper penalty. Why?
    • It’s individualized and enforceable: violate it and you face contempt or enhanced DTSA remedies without relitigating liability; courts treat injunction breaches as defiance of the court itself [4].
    • It preserves partner confidence without messy discovery: depositions and brand-deck productions would risk fresh leaks. An injunction locks the door; a damages trial opens the blinds. That trade-off is rational for Epic and for licensors who prefer to stay out of the record [2][4].

Back-of-envelope: what a “spoiled” collab can cost (hypothetical scale)

  • Anchor: Sacra estimates Epic’s 2024 revenue at about $5.7 billion, with Fortnite as the driver [5].
  • Hypothesis: If diminished “surprise” clips even 0.5% of annual monetization across a few anchor drops, then:
    • $5.7B × 0.5% = $28.5M at risk in a year (scale illustration, not a damages claim) [5].

2x2: leak types Epic actually cares about

  • Axis A (Epic info location): internal systems vs. public game builds [4].

  • Axis B (timing window): pre-build plans vs. in-build assets, which dictates DTSA exposure and PR risk [4].

  • Insider pre-build (most severe): Internal roadmaps, partner pitch decks, and code names—what Epic alleged here. Consequence: direct DTSA exposure and reputational damage with licensors [2][4].

  • Insider in-build: Early access to staging/QA branches; still severe (see Epic’s 2019 case vs. a tester who leaked the Chapter 2 map) [6].

  • Public in-build (datamining): Players parse shipped binaries; often tolerated unless it prematurely reveals licensed IP like South Park or Minecraft [1].

  • External partner leak: Retail listings or vendor packshots. Contractual friction and takedowns usually contain it, but timing damage still lands [1].

Cohen’s case sits top-left (insider/pre-build), which explains a push for a permanent injunction rather than a headline damages number that would prolong attention on the leaks [1][2][4][6].

Historical analogue: Pokémon’s 2021 hammer vs. leakers

In 2021, The Pokémon Company secured $150,000 apiece from two Sword and Shield leakers who posted strategy-guide images ahead of launch, showing courts will back meaningful monetary penalties tied to pre-release marketing assets [7]. Epic’s path differs—favoring a stipulated injunction—but the throughline is similar: when surprise becomes product, premature disclosure is framed and treated as trade secret misappropriation under federal or state law [4][7].

Named-stakeholder breakdown

  • Epic Games: An injunction-centric outcome delivers a standing enforcement tool and reduces discovery that could expose internal processes or partner contracts. It also signals to staff and contractors that DTSA remedies—not just NDAs—govern insider conduct [2][4].
  • Microsoft/Mojang and Blizzard (Minecraft, Overwatch): Fewer uncontrolled spoilers mean cleaner timing across Xbox, Battle.net, and social beats, stabilizing conversion models for Item Shop windows and Twitch drops [1].
  • South Park rights holders (e.g., South Park Digital Studios/Paramount affiliates): Comedy IP depends on reveal timing; leaks dull punchlines. A consistent legal posture from Epic lowers brand risk on future crossovers [1].
  • “Leak economy” accounts on X/Discord: A federal injunction targeting an alleged insider shifts risk: amplify a known-insider leak and you may face subpoenas or preservation demands, even if you never touched Epic systems [2][4].
  • Competing publishers: Expect imitation. Nintendo, The Pokémon Company, and Epic are converging on a norm: escalate insider cases under DTSA or equivalents, reserve PR-friendly takedowns for datamining [6][7].

Why the Fortnite leaker settlement is more than PR cleanup

Epic’s complaint was filed March 5, 2026, in the Eastern District of North Carolina (Case No. 5:26-cv-00135-BO) and alleges Cohen—operating AdiraFN/AdiraFNInfo—“repeatedly misappropriated Epic’s trade secret information” via X and Discord while bound by an NDA, seeking injunctive relief plus compensatory damages and fees [3]. The proposed deal delivers the first ask: a court-ordered ban on accessing or sharing Epic’s confidential info, which removes the account’s unique edge [1][2][3]. Without insider pre-build access, any future presence would devolve into ordinary datamining rather than live-plan disclosure [1]. Under 18 U.S.C. § 1836, injunctions must be based on evidence of threatened misappropriation, cannot be used to bar employment per se, and can be paired with royalties or damages for future misuse—deterrence that follows the defendant across jobs and platforms [4].

What others are missing

Coverage focused on the absence of a damages figure. The overlooked angle is discovery risk management: a full-dress damages trial could force emails, roadmaps, or draft licensing terms into the record, compounding exposure for South Park Digital Studios, Mojang, and Blizzard. By securing a stipulated injunction under a federal statute tailored to trade secrets, Epic minimizes the chance of partner materials hitting PACER or the tech press while still obtaining ongoing relief [1][2][4].

What to watch next

  1. By Q3 2026, Epic will update contractor NDAs and onboarding to cite DTSA remedies and ex parte seizure provisions, and at least one hire will publicly reference these changes in job docs or a LinkedIn post.
  2. By Q4 2026, at least one major publisher besides Epic will file a DTSA-centered complaint against an insider leaker tied to a live-service crossover, with the primary prayer for relief being a permanent injunction.
  3. By Q2 2027, a Fortnite partner named in the 2026 leaks (Minecraft, Overwatch, or South Park) will run a synchronized relaunch or “reprise” event, confirming partner retention post-settlement.

My take

Epic picked the right hill to hold. A clean, court-backed injunction beats a pyrrhic damages press release that trades headlines for discovery risk [2][4]. When Fortnite remains a multibillion-dollar franchise on 2024 revenue estimates, even small percentage swings justify aggressive timing protection [5]. I expect more studios to mirror this template: move fast in federal court, lock the injunction, and starve the leak economy of its only real edge [2][4].

Sources

  1. Epic settles with Fortnite leaker who shared South Park, Minecraft and Overwatch collabs — Video Games Chronicle (https://www.videogameschronicle.com/news/epic-settles-with-fortnite-leaker-who-shared-south-park-minecraft-and-overwatch-collabs/) — Baseline report on the settlement, brands implicated, follower count, and Epic’s on-record statement.
  2. Epic reaches lawsuit settlement with former contractor who was also a notorious Fortnite leaker — PC Gamer (https://www.pcgamer.com/games/epic-reaches-lawsuit-settlement-with-former-contractor-who-was-also-a-notorious-fortnite-leaker/) — Confirms proposed settlement terms (permanent bar via injunction), timing, and lack of disclosed monetary relief.
  3. Complaint, Epic Games, Inc. v. Hayden Cohen (Case 5:26-cv-00135-BO) — DocumentCloud (https://s3.documentcloud.org/documents/27772901/epic-games-v-hayden-cohen-complaint.pdf) — Primary filing establishing venue, allegations of insider misappropriation, and requests for injunctive relief and damages.
  4. 18 U.S.C. § 1836 (Defend Trade Secrets Act) — Cornell Law School Legal Information Institute (https://www.law.cornell.edu/uscode/text/18/1836) — Statutory basis for injunctions and remedies in federal trade secret cases; explains the potency of tailored injunctive relief.
  5. Epic Games revenue estimate 2024 — Sacra (https://sacra.com/c/epic-games/) — Independent estimate used to size the hypothetical financial impact from “spoiled” surprise drops.
  6. Epic sues tester over Fortnite Chapter 2 leaks — Video Games Chronicle (https://www.videogameschronicle.com/news/epic-sues-tester-over-fortnite-chapter-2-leaks/) — Context on Epic’s prior insider-leak litigation in 2019 against a QA tester.
  7. Pokémon Sword and Shield leakers to pay $150,000 each — GameSpot (https://www.gamespot.com/articles/pokemon-sword-and-shield-leakers-to-pay-150000-each-to-nintendo-for-damages/1100-6493184/) — Historical analogue showing courts awarding significant damages for pre-release marketing asset leaks.

Flores Subpoenas Pull 25 NFL Teams | Analysis by Brian Moineau

TL;DR

  • Brian Flores’ legal team subpoenaed 25 of the NFL’s 32 clubs and issued more than 1,000 discovery requests, pulling about four-fifths of the league into potential document and chat production tied to his race discrimination suit. [1]
  • The requests reportedly include a 24-year lookback, converting this into a long‑horizon paper-and-messages hunt well beyond the six teams named in the complaint. [1]
  • The real fight in 2026 isn’t email; it’s whether iMessage, WhatsApp, Slack, and Teams data survive preservation and production battles, because candid hiring chatter often moved off email after 2015. [6][10]

What the source said

ESPN reported that Flores’ counsel served subpoenas on 25 teams and sent more than 1,000 discovery requests in federal court, seeking communications, interview files, and policy documents on hiring practices that he says reflect systemic bias. The requests aim at “sham” interview evidence and Rooney Rule compliance trails from coaches’ slates to reference notes. The matter sits in the Southern District of New York with discovery disputes active, and the filing did not publicly identify which 25 clubs were subpoenaed. [1][2]

Why it matters

Since the NFL adopted the Rooney Rule in 2003, clubs have had to document certain interview steps, but those artifacts rarely see daylight; court‑ordered production could reveal how decision paths formed over two decades. For Black coordinators and position coaches, that means scorecards, finalist lists, and notes that show if “fit” correlated with predetermined choices. [3]

Owners, presidents, and general managers now face broad nonparty discovery risk across phone, cloud, and chat repositories. Even when courts narrow scope, long‑tail PR damage can follow—as it did in 2021 when leaked Washington Football Team materials led to Jon Gruden’s resignation after emails became public. [5]

Original analysis

Scope math and posture

  • Breadth: 25 of 32 clubs were subpoenaed—78.1% of the league. If you include the six defendant teams also named in filings, up to 31 clubs could be touched, or 96.9% of the NFL’s membership. 25 ÷ 32 ≈ 78.1%; (25 + 6) ÷ 32 ≈ 96.9%. [1]
  • Timeframe: A 24‑year lookback implies 25 clubs × 24 seasons = 600 club‑years of potentially responsive hiring material, even before you count the defendant teams. [1]
  • Posture: The case proceeds in S.D.N.Y. before Judge Valerie Caproni, who previously split claims between court and arbitration and is now refereeing discovery scope and burden fights. [2]

Back‑of‑envelope cost signal: Processing data to get it into review commonly runs tens to low hundreds of dollars per gigabyte before attorneys read a single message; $25–$125/GB is a published range, which scales fast across phones, laptops, and chat exports for dozens of custodians. The dollar figure is secondary to the institutional risk that candid strings surface in public filings or hearings. [4]

A simple 2×2 for where “smoking guns” live

  • Record type (structured vs. unstructured) × Custody (corporate vs. personal) creates four buckets:
    • Structured/corporate: applicant tracking systems, HRIS fields, and calendar invites from 2010–2024; low heat, high completeness.
    • Structured/personal: rare, e.g., interview scorecards saved in a coach’s personal Google Drive; moderate heat, tricky custody.
    • Unstructured/corporate: email threads and Slack/Teams channels created after 2016; high heat, improved admin logs.
    • Unstructured/personal: iMessage/WhatsApp/Signal on BYOD devices from executives and scouts; very high heat, highest spoliation risk if auto‑delete or “disappearing” settings were active. [6][7][10]

Historical analogue (what it predicts)

In October 2021, New York Times reporting on leaked emails tied to the Washington investigation triggered Jon Gruden’s resignation from the Raiders; those messages were collateral to another probe and not the centerpiece of a hiring lawsuit. When discovery spans most teams in 2026–2027, analogous reputational shrapnel becomes more likely even if the court narrows scope. Expect at least one unflattering exchange about “preselected” candidates to surface once exhibits become public. [5]

Contrarian read

Conventional wisdom says judges will prune the asks as a fishing expedition and the league will settle quickly to stop leaks. That overlooks coordination frictions: 25 nonparty clubs each have distinct counsel, archives, and risk tolerances, which complicates any global off‑ramp. It also misreads incentives in 2026, when validating documented interview processes offers the league a reason to litigate proportionality and preserve the narrative that Rooney Rule steps reflect genuine consideration. [1][2]

Named‑stakeholder breakdown

  • Judge Valerie Caproni (S.D.N.Y.): She will decide what portions of the 24‑year scope survive, which custodians matter, and whether mobile/chat data must be imaged and produced; those orders will set national headlines. [2]
  • NFL headquarters: Park Avenue lawyers must coordinate objections, search terms, and rolling productions across 25 nonparties, where a single email chain can sink months of DEI messaging. [1]
  • Giants, Broncos, Texans: As defendants named in Flores’ 2022 complaint, their 2019–2022 HC and coordinator searches face the closest scrutiny and earliest deadlines. [2]
  • Minnesota Vikings: Flores served as defensive coordinator in 2023, creating added sensitivity around any interview files or communications that reference his candidacies and evaluations. [1]
  • Black coordinator pipeline: QB, DC, and OC candidates interviewed between 2010 and 2024 could gain empirical artifacts—finalist slates, rubric scores—to contest “fit” narratives that often lack auditable evidence. [3]

What others are missing

The most consequential fight is over collaboration and mobile data, not email. In 2023, a federal court sanctioned Google for auto‑deleting Chats in a DOJ antitrust case, signaling that ephemeral or “history off” settings won’t shield candid business communications from discovery or sanctions. The FTC’s Model Second Request and modern ESI protocols explicitly press for Slack/Teams/WhatsApp data and mobile collections, which means clubs that failed to lock down BYOD phones when litigation was reasonably anticipated face real spoliation exposure. That is where interview‑theater vs. substantive‑consideration evidence will likely appear. [6][10][7]

What to watch next

  1. By August 30, 2026, Judge Caproni will narrow—but not quash—the nonparty subpoenas, compelling at least interview notes, finalist slates, and job descriptions from 2010–2024 for a subset of custodians.
  2. By December 31, 2026, at least one internal club communication about a head‑coach interview will appear in a public filing or hearing exhibit and trigger either an internal review or formal discipline announced by a team or the league.
  3. By November 15, 2026, at least one motion for sanctions alleging spoliation of chat or text messages (iMessage, WhatsApp, Slack, or Teams) will be filed on the public docket in S.D.N.Y. in this case.

Sources

[1] ESPN — Report on Flores’ subpoenas to 25 teams and 1,000+ discovery requests; anchors breadth, timeframe, and nonparty scope.
[2] Reuters — Coverage of Judge Valerie Caproni’s rulings in Flores v. NFL; establishes S.D.N.Y. posture and discovery/arbitration context.
[3] NFL Operations (Rooney Rule overview) — Documents the rule’s 2003 adoption and interview‑process intent; frames what records clubs likely kept.
[4] ComplexDiscovery ESI Pricing Survey (2023–2024) — Benchmarks eDiscovery processing costs in the $25–$125/GB range; supports cost math.
[5] New York Times (Oct. 11, 2021, Jon Gruden emails/resignation) — Historical analogue for collateral disclosure risk from unrelated probes.
[6] U.S. v. Google LLC (N.D. Cal. 2023, Chat spoliation order) — Demonstrates courts’ intolerance for ephemeral messaging deletions; pertinent to Slack/Chat/iMessage disputes.
[7] The Sedona Conference, Commentary on Ephemeral Messaging (2023) — Best‑practice guidance on preserving mobile and chat data; informs sanctions risk.
[10] FTC, Model Second Request (2021 update) — Explicitly addresses collaboration tools and mobile collections; maps to civil discovery expectations.




Related update: We recently published an article that expands on this topic: read the latest post.


Related update: We recently published an article that expands on this topic: read the latest post.


Related update: We recently published an article that expands on this topic: read the latest post.


Related update: We recently published an article that expands on this topic: read the latest post.