A recent incident has revealed that achievement details for games that have not yet been released—or even officially announced—have unintentionally become visible on public tracking services such as Exophase and SteamDB. The leak includes high‑profile titles like the upcoming entries Fable, Persona 6, Kingdom Hearts 4, and the upcoming Control: Resonant, among many others. The problem appears to stem from a bug introduced by Valve during its routine weekly maintenance window.
Simon Carless, the founder of GameDiscoverCo, explained that Valve "unfortunately rolled out a major bug around achievements" which caused the platform’s internal achievement database to be exposed to automated crawlers. These crawlers, which normally collect achievement data for completed and publicly listed games, ended up pulling information for every Steam title that has an achievement system attached, regardless of its release status.
"As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased... or even unannounced," Carless said in an interview.
This means that even games that are still in development, have no official marketing push, or are being kept under wraps for strategic reasons have had their achievement lists indexed and displayed on third‑party sites. Mike Bendel, the owner of Exophase, clarified that the situation is not a deliberate data breach but rather an unintended side effect of Valve's error.
Responding to a user query on the ResetEra forum, Bendel wrote, "a bunch of games with achievements that should be private are accessible through API right now and that's why they got scanned into the site." He added that normally Exophase never sees entries for games that lack a public title; when the API returns an unknown name, the service substitutes the numeric AppID as a placeholder. Over the past hour, however, a noticeable spike of such placeholder entries appeared, prompting the investigation. The leak is not limited to the flagship franchises mentioned earlier.
According to reporting by Gematsu, a wide variety of other projects were also affected. Titles such as Gears of War: E‑Day, the upcoming multiplayer shooter Clutch, Horizon Hunters Gathering, the next Ace Combat installment (Ace Combat 8), Metro 2039, Star Wars: Galactic Racer, Stranger Than Heaven, Rayman Legends: Retold, and Tomb Raider: Legacy of Atlantis all had their achievement data unintentionally exposed. While some of these games have been hinted at in the past, many were completely unknown to the public before this incident.
GamesIndustry.biz has reached out to Valve for comment and further clarification on the scope of the issue, but as of now the company has not issued a detailed public statement beyond acknowledging the bug. The incident raises broader questions about how Steam’s API handles sensitive data and whether additional safeguards are needed to prevent private or pre‑release information from being scraped by third‑party services.
It is worth noting that this is not the first time Valve has faced scrutiny over data security. In July, the company confirmed that personal information belonging to European customers was compromised after a breach at CEVA Logistics, the regional shipping partner responsible for delivering Steam hardware. The attack on CEVA occurred between July 29 and August 1, and Valve only became aware of the intrusion on August 7.
That breach resulted in the exposure of names, email addresses, and partial payment details for thousands of users. The current achievement leak, while less severe in terms of personal data, still poses potential risks for developers. Achievement lists can reveal design intentions, narrative beats, or gameplay mechanics that studios may wish to keep secret until an official announcement. Moreover, premature exposure can spoil marketing plans, affect hype cycles, and even give competitors a glimpse into a game's progression system.
Valve has a long history of providing developers with tools to manage achievements, including the ability to hide or delay the release of achievement data. The recent bug suggests that the automation around these controls may have malfunctioned, allowing the API to return data that should have been flagged as private. In response, industry observers are calling for Valve to implement stricter authentication for API calls that request achievement information, as well as more robust testing procedures before rolling out maintenance updates.
For gamers who frequent sites like Exophase or SteamDB, the incident serves as a reminder that not all information displayed on those platforms is officially sanctioned. While achievement trackers are valuable for competitive players and completionists, the data they pull is only as reliable as the source's integrity. When a platform-wide bug occurs, the ripple effect can reach thousands of users worldwide, creating confusion and potentially eroding trust. In the meantime, developers whose games were inadvertently listed are likely to request immediate removal of the leaked achievement data from third‑party sites.
Some may also consider issuing statements to reassure fans that no gameplay content has been compromised and that the achievement lists will be corrected once Valve resolves the underlying issue. Overall, the episode underscores the delicate balance between transparency for the gaming community and the need to protect unreleased content. As Valve works to patch the bug and restore normal API behavior, both the industry and the player base will be watching closely to see how quickly the situation can be remedied and what steps will be taken to prevent a similar occurrence in the future.