In what is being called a massive security failure for the gaming technology industry, the highly anticipated racing title Forza Horizon 6 was leaked and cracked more than a week before its official launch. The entire 155-gigabyte PC build of the game was accidentally uploaded to Steam in an unencrypted state by Microsoft and Playground Games, allowing pirate groups to bypass security measures almost immediately.
The leak occurred earlier today as the developers prepared for the game’s scheduled global release on May 19, 2026. Because the files were pushed to the public-facing Steam servers without their intended digital locks, the game was fully playable for anyone who managed to download the massive data package. This breach represents a growing crisis in digital distribution where internal operational errors are now causing more damage to software security than external hacking attempts.
The accidental upload that bypassed Microsoft’s own encryption
The incident was not the work of a sophisticated cyberattack but was instead caused by a severe internal oversight. According to a report by Windows Central, Microsoft itself was responsible for the upload that left the PC files exposed on the Steam storefront. While preloads are a standard feature for major releases, they are usually protected by a decryption key that is only sent out on the actual launch day. In this case, the key was essentially left in the lock.
Piracy groups on sites like Reddit and SteamDB quickly flagged the error. Within hours, a cracked version of the game was circulating on illicit file-sharing platforms. Despite the leak, Forza Horizon 6 is still performing well commercially, holding its spot as the second highest-selling game by revenue on the Steam charts. But the availability of a free, fully functional version a week before the Premium early access on May 15 has caused significant PR damage for Xbox and its partners.
Historical failures and the crackdown on players
Playground Games has responded to the crisis with a zero-tolerance policy. The studio said it will issue permanent bans to any user detected playing the cracked version while connected to online services. Community moderators have also started scrubbing forums to stop the spread of download links. This is a nightmare for a studio that has spent years building one of the most polished racing franchises in history.
This event is not an isolated incident in 2026. It is the second major Steam preload failure this year, according to The Times of India, which noted that the 113GB build of Death Stranding 2 suffered a near-identical fate in March. The repeating nature of these mistakes suggests that the current automated pipelines used to deliver massive games are fundamentally broken or lack necessary human verification steps.
Why the Forza breach forces a rethink of Steam’s preload pipeline
The recurring failure of the preload system indicates a paradigm shift in how major publishers must handle digital security. For years, the industry focused on stopping “Day One” cracks from external hackers, but the real threat has shifted to the “Pre-Release Leak” caused by internal logistics. This latest disaster with Forza Horizon 6 proves that even the most robust encryption is useless if the delivery platform fails to activate it during the upload process.
We are likely to see an industry-wide overhaul of how preloads work. Major studios may move away from “hot” uploads and instead move toward a multi-stage verification system that requires manual sign-offs from both the developer and the storefront before files go live. For the fans, this might mean later preload windows or more frequent “Day Zero” patches. For Microsoft and Valve, it means rebuilding a trust architecture that has now allowed two of the biggest games of 2026 to be given away for free by mistake.