Steam Achievement Data for Unreleased and Unannounced Titles Exposed on Sites Like Exophase and SteamDB

A recent incident has brought to light that achievement data for games that have not yet been released—or even officially announced—has unintentionally become visible on public achievement tracking services such as Exophase and SteamDB. The leak includes high‑profile upcoming titles like the next entry in the Fable series, Persona 6, Kingdom Hearts IV, and the upcoming Control: Resonant expansion, among many others.

The problem appears to stem from a bug introduced during Valve’s routine weekly maintenance window. Simon Carless, the founder of GameDiscoverCo, explained that Valve "unfortunately rolled out a major bug around achievements" during this scheduled update.

This glitch caused the Steam backend to expose achievement metadata for every game that has an achievement system attached, regardless of whether the title is currently available to the public or even officially listed on Steam. Because a number of third‑party services rely on Valve’s public API to automatically gather achievement information, these services began pulling data for the hidden titles as well. "As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased...

or even unannounced," Carless said. Mike Bendel, the owner of Exophase, clarified that the situation is not the result of a deliberate data breach but rather an unintended side effect of Valve’s error. In a response to a user on the ResetEra forum, Bendel wrote, "a bunch of games with achievements that should be private are accessible through API right now and that's why they got scanned into the site." He added that his platform typically does not display games lacking a proper title; however, in the past hour or so, a slew of entries appeared with only an AppID placeholder, indicating that the system was pulling raw data for titles that have not yet been publicly named.

The list of affected games extends far beyond the headline‑grabbing titles. According to reporting from Gematsu, other projects whose achievement data surfaced include Gears of War: E‑Day, the upcoming multiplayer title Clutch, Horizon Hunters Gathering, Ace Combat 8, Metro 2039, Star Wars: Galactic Racer, Stranger Than Heaven, Rayman Legends: Retold, and Tomb Raider: Legacy of Atlantis. Each of these games, some of which are still in early development stages or have been kept under wraps, now has a partial achievement list visible to anyone who queries the public API. The exposure raises several concerns for developers and publishers.

Achievements are often used as a marketing tool, and early visibility can spoil planned reveal strategies or hint at gameplay mechanics before a studio is ready to share them. Moreover, the premature disclosure of achievement titles can lead to speculation and misinformation within the gaming community, potentially affecting hype cycles and consumer expectations.

GamesIndustry.biz has reached out to Valve for comment and further details about the scope of the bug, the timeline for a fix, and any steps being taken to prevent similar incidents in the future. While Valve has not yet issued a formal statement specific to this achievement leak, the company’s history of addressing security and data‑related issues suggests that a patch to the API handling will be prioritized. This incident also revisits a prior security event involving Valve that occurred earlier in the year.

In July, Valve confirmed that personal data belonging to European customers had been compromised as a result of a breach at CEVA Logistics, the regional shipping partner responsible for distributing Steam hardware. The breach at CEVA took place between July 29 and August 1, with Valve learning of the intrusion on August 7. That episode underscored the importance of third‑party security practices for companies that handle sensitive user information. In the context of the current achievement data leak, the key takeaway for the industry is the need for rigorous testing of any changes to public-facing APIs, especially those that could inadvertently expose unreleased content.

Developers may need to implement additional safeguards, such as flagging achievements as "private" until a game’s official launch, or employing rate‑limited access tokens that restrict automated scraping during maintenance windows. For gamers and fans who monitor sites like Exophase and SteamDB for upcoming titles, the situation serves as a reminder that not all information displayed on these platforms is officially sanctioned.

While the excitement of discovering hidden achievements can be tempting, it is important to treat such data with caution until the developers themselves confirm the details. Valve’s engineering team is expected to release a corrective update soon, which should close the loophole that allowed the API to return achievement data for unpublished titles. In the meantime, both Exophase and SteamDB have indicated they will temporarily suspend the automatic collection of achievement data while the issue is being resolved, to prevent further unintended disclosures.

Overall, this episode highlights the delicate balance between providing transparent, community‑driven achievement tracking and protecting the confidentiality of upcoming game content. As the industry continues to rely on third‑party aggregators for player statistics and achievement showcases, robust safeguards and clear communication channels between platform operators and developers will be essential to avoid similar leaks in the future.