In a surprising turn of events, data about Steam achievements for games that have not yet been released—or even officially announced—has surfaced on public tracking sites such as Exophase and SteamDB. The leak includes titles that fans have been eagerly anticipating, such as the next installment of the Fable series, Persona 6, Kingdom Hearts 4, and the upcoming Control: Resonant expansion. The issue was first highlighted by Simon Carless, the founder of GameDiscoverCo, who explained that Valve inadvertently introduced a significant bug during its routine weekly maintenance window.
According to Carless, the bug caused the Steam achievement system to expose information that was supposed to remain hidden until a game’s official launch. As a result, automated services that scrape Steam’s achievement API—most notably Exophase and SteamDB—ended up pulling data for every title that has any achievement entries, regardless of whether the game is already on the market, still in development, or even completely unannounced.
Mike Bendel, the owner of Exophase, clarified that the situation is not a deliberate data breach but rather a side effect of Valve’s error. In a response to a user on the ResetEra forum, Bendel said, "A bunch of games with achievements that should be private are accessible through the API right now, and that’s why they got scanned into the site." He added that his platform typically does not display games lacking a proper title; however, in the past hour or so, numerous entries appeared with only an AppID placeholder because the official name was not yet known.
The leak is not limited to the high‑profile titles mentioned earlier. According to coverage by Gematsu, a broader list of games also had their achievement data unintentionally exposed. This list includes Gears of War: E‑Day, the upcoming multiplayer title Clutch, Horizon Hunters Gathering, Ace Combat 8, Metro 2039, Star Wars: Galactic Racer, Stranger Than Heaven, Rayman Legends: Retold, and Tomb Raider: Legacy of Atlantis.
Each of these entries showed achievement progress or requirements that were meant to stay confidential until the developers chose to reveal them. GamesIndustry.biz has reached out to Valve for comment and further clarification, seeking to understand the scope of the problem and what steps the company will take to prevent a recurrence. While Valve has not yet issued a detailed public statement on this specific achievement leak, the incident arrives on the heels of a separate security incident that took place earlier in the year. In July, Valve confirmed that personal data belonging to European customers had been compromised after a breach at CEVA Logistics, the regional shipping partner responsible for delivering Steam hardware.
The attack on CEVA Logistics occurred between July 29 and August 1, and Valve only became aware of the breach on August 7. That incident highlighted the broader challenges the company faces in safeguarding both user data and internal systems. The current achievement exposure raises several concerns for developers, publishers, and the gaming community. For developers, achievement lists often contain spoilers or reveal design intentions that could affect marketing strategies or player expectations.
Publishers may need to adjust their rollout plans if achievement details become public prematurely. Meanwhile, gamers who follow achievement trackers might inadvertently discover hidden content or story elements before the official release, potentially diminishing the surprise factor that many titles rely on. From a technical standpoint, the bug appears to be tied to how Valve’s maintenance scripts interact with the achievement database. During the weekly maintenance window, a routine update is supposed to refresh achievement metadata without exposing it to external queries.
However, an error in the script likely left the API endpoint open, allowing third‑party services to query the full list of achievement entries for every AppID in the Steam catalog. Because these services operate automatically, they captured the data in real time and populated their databases within minutes. Valve’s standard practice for handling private achievement data involves marking entries as "hidden" until the associated game reaches a certain release milestone.
When the bug occurred, those hidden flags were not applied, effectively treating every achievement as public. This oversight underscores the importance of rigorous testing and validation of maintenance procedures, especially for a platform as large and complex as Steam. Looking ahead, the community can expect Valve to roll out a hotfix aimed at re‑securing the achievement API and re‑applying the appropriate privacy flags to all affected titles.
In addition, Valve may need to communicate directly with developers whose games were impacted, offering guidance on how to mitigate any potential fallout, such as temporarily disabling achievement tracking or issuing statements to manage player expectations. For users of Exophase, SteamDB, and similar sites, the incident serves as a reminder that the data displayed on these platforms is only as reliable as the source APIs they rely on. While these services provide valuable insight into game progress, leaderboards, and achievement completion rates, they are ultimately dependent on the integrity of the underlying data provided by Steam. When that data is inadvertently exposed, it can lead to misinformation or premature leaks.
In summary, a maintenance‑related bug on Valve’s side caused achievement data for a wide range of Steam titles—some of which are still under development or have not even been announced—to become publicly accessible via third‑party tracking sites. The leak includes major franchises such as Fable, Persona, Kingdom Hearts, and Control, as well as a host of other upcoming games. Valve has yet to issue a comprehensive response, but the incident highlights the need for stronger safeguards around private game metadata and the importance of swift remediation when such vulnerabilities arise.