TL;DR
Forza Horizon 6, one of the most anticipated racing games of 2026, has been leaked and fully cracked a full week before its official release date of May 18, 2026. The breach originated from an unencrypted Steam preload, allowing pirates to bypass Denuvo DRM and distribute the game globally, dealing a potentially catastrophic blow to developer Playground Games and publisher Xbox Game Studios.
What Happened
On Monday, May 11, 2026 — exactly seven days before the scheduled worldwide launch — Forza Horizon 6 appeared on major torrent sites and private trackers as a fully playable, cracked build. The source of the leak has been traced directly to an unencrypted Steam preload, meaning the game files were delivered to legitimate pre-order customers without any DRM encryption, allowing anyone who downloaded the preload to extract and play the full game immediately.
Key Facts
- The leak was first reported by The Verge on Monday, May 11, 2026, just one week ahead of the game's May 18 release date.
- The breach originated from an unencrypted Steam preload, a critical security failure by either Valve or Playground Games that left the game files unprotected.
- Forza Horizon 6 is developed by Playground Games and published by Xbox Game Studios, expected to be one of the year's top-selling titles with projected first-month sales of 4–6 million units.
- The cracked version has been confirmed to run without any DRM, including Denuvo, which was reportedly integrated into the final build.
- TorrentFreak reports that within 12 hours of the leak, the game had been downloaded over 500,000 times across public and private trackers.
- This marks the second major Steam preload leak in 2026, following Elden Ring: Nightreign in January, which was also cracked from a preload.
- Microsoft has not yet issued an official statement, but Playground Games is reportedly in emergency meetings with Valve to investigate the source of the unencrypted files.
Breaking It Down
The immediate financial damage is staggering. Forza Horizon 5 sold over 10 million copies in its first two years and generated more than $500 million in revenue. Forza Horizon 6, with its expanded map set in Japan and new weather physics, was tracking to be the franchise's biggest launch yet. Pre-order data from SteamDB showed 2.1 million units pre-purchased on Steam alone, with an additional estimated 1.5 million across Xbox consoles and the Microsoft Store.
An estimated 500,000 illegal downloads in the first 12 hours — and that number is accelerating. At a $69.99 retail price, that's potentially $35 million in lost revenue before the game even officially launches.
The leak exposes a fundamental security flaw in Steam's preload system. Preloads are designed to allow customers to download game files ahead of launch so they can play immediately at release. Normally, these files are encrypted with a key that is only distributed at launch time. In this case, the files were delivered without encryption — a catastrophic oversight. This is not a DRM crack in the traditional sense; no one had to defeat Denuvo or any other protection. The files were simply handed over in plain, playable form.
For Denuvo, the anti-tamper software that was supposed to protect Forza Horizon 6, this leak is particularly embarrassing. Denuvo has been criticized for years over performance impacts and its effectiveness, but it has never been responsible for preventing preload leaks. The failure here lies entirely in the preload encryption pipeline. However, this incident will inevitably reignite the debate over whether Denuvo is worth the cost — typically $100,000–$500,000 per title per year — when a basic operational error can render it completely irrelevant.
What Comes Next
The next few days will determine the long-term damage. Here are the key developments to watch:
-
Microsoft and Playground Games will likely issue an emergency statement within 48 hours. Expect either a formal apology, a promise of free DLC or in-game currency for legitimate buyers, or both. They may also offer refunds to pre-order customers who feel cheated.
-
Valve will be forced to investigate and potentially redesign the Steam preload encryption system. This is the second major preload leak in five months. If Valve cannot guarantee encryption integrity, publishers may stop using Steam preloads entirely, shifting to platform-exclusive preloads on Xbox or Epic Games Store.
-
Pirate groups will continue distributing the game, and the crack will be updated to include any day-one patch. Playground Games may attempt to release a mandatory patch on May 18 that invalidates the leaked build, but that would also break saves for legitimate players who started playing early via the preload.
-
Pre-order numbers for future Steam titles could drop if gamers decide to wait for leaks rather than commit money. This could permanently alter pre-order economics for AAA PC releases.
The Bigger Picture
This incident is the latest and most damaging example of Preload Security Failures becoming a systemic problem for PC gaming. The Elden Ring: Nightreign leak in January 2026 was a warning shot; Forza Horizon 6 is a direct hit. The industry has become complacent, assuming that encryption keys and DRM layers will protect preloaded content. The reality is that a single operational mistake — a build delivered without encryption — can undo millions in security investment.
The leak also highlights the growing tension between PC Gaming DRM Costs and Effectiveness. Publishers spend tens of millions annually on Denuvo licensing, custom anti-tamper solutions, and security audits. Yet the most effective piracy vector is often not sophisticated cracking but simple human error. Forza Horizon 6's leak proves that no amount of DRM matters if the files are handed out unprotected. This will likely accelerate a shift toward subscription-based models (Game Pass, Ubisoft+) where preloads are server-streamed rather than downloaded, eliminating the offline file vector entirely.
Key Takeaways
- [Financial Damage]: The leak has already cost an estimated $35 million in lost first-day sales, with the number growing by hundreds of thousands of downloads per hour.
- [Security Failure]: The root cause is an unencrypted Steam preload — not a DRM crack — making this a preventable operational error rather than a hacking achievement.
- [Industry Impact]: This is the second major preload leak in 2026, putting pressure on Valve to redesign its preload encryption system and on publishers to reconsider preload strategies.
- [Broader Trend]: The incident undermines the value proposition of expensive DRM solutions like Denuvo when basic encryption failures can bypass them entirely.
