A recent incident has revealed that achievement data for several games that have not yet been released—or even officially announced—has been inadvertently exposed on public tracking platforms such as Exophase and SteamDB. Among the titles whose achievement lists were unintentionally made visible are high‑profile projects like the upcoming Fable installment, Persona 6, Kingdom Hearts 4, and the upcoming Control: Resonant edition.
The problem appears to stem from a bug introduced during Valve's routine weekly maintenance window. Simon Carless, the founder of GameDiscoverCo, explained that Valve "unfortunately rolled out a major bug around achievements" during this scheduled downtime. As a consequence, automated services that scrape Steam's achievement data—most notably Exophase and SteamDB—ended up pulling information for every game that possesses an achievement framework, regardless of whether the game is already on the market, still in development, or even officially announced to the public.
Mike Bendel, the owner of Exophase, clarified that the situation is not the result of a deliberate data leak but rather an unintended side effect of Valve's error. In a response to a user query on the ResetEra forum, Bendel wrote, "A bunch of games with achievements that should be private are accessible through the API right now, and that's why they got scanned into the site." He added that his system typically does not display games that lack a proper title, but during the brief window when the bug was active, many entries appeared under their numeric AppID because the platform could not retrieve a conventional name.
The leak has affected a surprisingly wide range of upcoming titles across multiple genres and publishers. According to coverage from Gematsu, the list includes: Gears of War: E‑Day, Clutch, Horizon Hunters Gathering, Ace Combat 8, Metro 2039, Star Wars: Galactic Racer, Stranger Than Heaven, Rayman Legends: Retold, and Tomb Raider: Legacy of Atlantis.
Each of these games now has its achievement structure visible on third‑party sites, providing a rare glimpse into the progression systems that developers have built for experiences that are still under wraps. GamesIndustry.biz has reached out to Valve for comment and further clarification about the scope of the issue, the timeline for remediation, and any potential impact on user privacy. While Valve has not yet issued a formal statement regarding this specific achievement data exposure, the company has a recent history of addressing security concerns.
In July, Valve confirmed that personal information belonging to European customers had been compromised after a breach at CEVA Logistics, the regional shipping partner responsible for delivering Steam hardware. Valve disclosed that the attack on CEVA took place between July 29 and August 1, and that the company became aware of the breach on August 7.
The current achievement leak raises several broader questions about how Steam's API handles sensitive or pre‑release content. Steam's public API is designed to provide developers and community services with access to a wealth of game‑related data, including achievement definitions, player statistics, and game metadata.
However, the API also includes mechanisms intended to keep unreleased or confidential information hidden until the developer explicitly makes it public. In this case, a flaw in Valve's maintenance routine appears to have bypassed those safeguards, temporarily exposing data that was meant to remain private.
For players and fans, the immediate impact is mostly a curiosity: seeing achievement titles and descriptions for games that have not yet been announced can spark speculation about upcoming features, story beats, or gameplay mechanics. For developers, however, the accidental disclosure can be a source of concern. Achievement design is often a carefully curated aspect of a game's overall experience, and premature exposure can spoil intended surprises or reveal design priorities before the marketing team is ready to share them. From a security perspective, the incident underscores the importance of rigorous testing and validation of any changes made during scheduled maintenance windows.
Even seemingly minor bugs can have outsized effects when they interact with widely used public interfaces. Valve's engineering team will likely need to review the processes that govern API exposure during maintenance, implement additional checks to ensure that private achievement data remains locked, and possibly introduce a delay or quarantine period for newly added achievement definitions until they are verified as public. In the meantime, third‑party aggregators like Exophase and SteamDB have taken steps to mitigate the situation.
Both sites have indicated that they are removing the inadvertently scanned entries and will monitor their systems for any further anomalies. Users who noticed the unexpected listings have been encouraged to report them, helping the platforms clean up the data quickly. Overall, while the leak does not appear to involve personal user data, it serves as a reminder that even large, established platforms can experience glitches that expose information developers intended to keep under wraps.
Valve's response and any subsequent policy adjustments will be closely watched by both the gaming community and industry observers, who hope that such incidents can be prevented in the future through more robust safeguards and transparent communication.