Steam Achievement Data for Unreleased and Unannounced Titles Exposed on Sites Like Exophase and SteamDB

A recent incident has revealed that achievement data for several Steam titles that have not yet been launched—or have not even been officially announced—has become publicly visible on third‑party aggregators such as Exophase and SteamDB. Among the titles whose hidden achievements were unintentionally exposed are high‑profile projects like *Fable*, *Persona 6*, *Kingdom Hearts 4*, and *Control: Resonant*. The leak was traced back to a bug introduced during Valve’s routine weekly maintenance window.

Simon Carless, the founder of GameDiscoverCo, explained that Valve "unfortunately rolled out a major bug around achievements" as part of that maintenance. The flaw caused the Steam API to return achievement information for every game that has an achievement list attached to it, regardless of whether the game is already on the market, still in development, or even officially announced. Because many community‑run sites rely on automated scripts that query the Steam API for achievement data, the bug meant that these scripts began pulling and displaying achievement entries for titles that were supposed to remain hidden. "As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased...

or even unannounced," Carless said. Mike Bendel, the owner of Exophase, clarified that the situation should be seen as a mistake on Valve’s part rather than a deliberate data breach.

In a response to a user on the ResetEra forum, Bendel wrote, "a bunch of games with achievements that should be private are accessible through API right now and that's why they got scanned into the site." He added that his platform typically never encounters entries for games without a proper title; however, in the past hour or so, the system started listing a series of unnamed entries, which the site labels by their numeric AppID when no official name is available. The scope of the exposure appears broader than the headline titles. According to reporting from Gematsu, additional games whose achievement data were unintentionally scraped include *Gears of War: E‑Day*, *Clutch*, *Horizon Hunters Gathering*, *Ace Combat 8*, *Metro 2039*, *Star Wars: Galactic Racer*, *Stranger Than Heaven*, *Rayman Legends: Retold*, and *Tomb Raider: Legacy of Atlantis*.

Each of these entries now shows a list of achievement names, descriptions, and sometimes even hidden criteria that developers had intended to keep under wraps until a formal reveal. GamesIndustry.biz has reached out to Valve for comment and further details about the bug’s origin, its impact, and the steps being taken to remediate the issue. While Valve has not yet issued a formal public statement specifically addressing this achievement leak, the company’s history of responding to security‑related incidents suggests that a patch will be deployed quickly to prevent further unauthorized data extraction. It is worth noting that this is not Valve’s first brush with data‑related problems this year.

In July, the company confirmed that personal information belonging to European Steam customers had been compromised as a result of a breach at CEVA Logistics, the regional shipping partner responsible for delivering Steam hardware. The intrusion at CEVA occurred between July 29 and August 1, with Valve becoming aware of the incident on August 7. That breach prompted Valve to issue a series of communications to affected users and to reinforce its security protocols across the supply chain. The current achievement exposure, while not as severe as a full‑scale personal data leak, still raises concerns for developers and publishers.

Achievements often serve as a marketing tool, hinting at gameplay mechanics, story beats, or hidden content that studios prefer to keep secret until they are ready to make an official announcement. When such information becomes publicly accessible, it can spoil surprise elements, affect pre‑launch hype, and potentially give competitors an unintended glimpse into a game’s design.

Developers may need to take immediate action to mitigate any fallout. Options include revoking the prematurely exposed achievement entries via the Steamworks backend, issuing statements to reassure fans that the leak does not impact the core experience, and possibly adjusting achievement structures to avoid further accidental disclosures. Some studios might also use the incident as an opportunity to engage with their communities, turning the unexpected glimpse into a teaser that fuels discussion while they prepare official marketing campaigns.

From a broader perspective, this episode underscores the importance of robust API governance and thorough testing of maintenance updates, especially for platforms as large and influential as Steam. Even a seemingly minor bug in a routine maintenance window can cascade into a public data leak that affects dozens of high‑profile projects. As the gaming industry continues to rely on interconnected services and real‑time data feeds, both platform operators and game developers must maintain vigilant oversight of how information is exposed, shared, and protected.

In summary, a maintenance‑related bug at Valve caused the Steam API to inadvertently expose achievement data for a range of unreleased and even unannounced games. Third‑party sites that automatically scrape this data, such as Exophase and SteamDB, have displayed these achievements, leading to a temporary leak of information that many developers had intended to keep confidential. While Valve has not yet provided a detailed public response, the incident highlights ongoing challenges in data security and API management within the gaming ecosystem.