A recent incident has revealed that achievement details for games that have not yet been launched—or even officially announced—have become visible on public tracking services such as Exophase and SteamDB. Titles that were previously hidden, including highly anticipated entries like *Fable*, *Persona 6*, *Kingdom Hearts 4*, and *Control: Resonant*, were unexpectedly listed with their associated achievement sets.
The leak was traced back to a bug introduced during Valve's routine weekly maintenance window. Simon Carless, the founder of GameDiscoverCo, explained that Valve "unfortunately rolled out a major bug around achievements" after this scheduled upkeep.
The flaw caused the Steam API to expose achievement metadata for every game that has an achievement framework attached, regardless of its release status. "As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased... or even unannounced," Carless said in an interview.
These collectors rely on the Steam Web API to pull structured data about each title, and the bug effectively removed the privacy gate that normally keeps pre‑release achievement tables hidden from public view. Mike Bendel, the owner of Exophase, clarified that the situation was not a deliberate data breach on his part but rather a side‑effect of Valve's error. Responding to a user on the ResetEra forum, Bendel wrote, "a bunch of games with achievements that should be private are accessible through API right now and that's why they got scanned into the site." He added that his platform typically does not display games lacking a proper name; however, in the past hour or so the system began populating entries with only the numeric AppID when the title field was empty, causing a flood of otherwise invisible entries to appear.
The issue extends beyond the headline titles. According to reporting from Gematsu, a wide array of other projects were also caught in the sweep, including *Gears of War: E‑Day*, *Clutch*, *Horizon Hunters Gathering*, *Ace Combat 8*, *Metro 2039*, *Star Wars: Galactic Racer*, *Stranger Than Heaven*, *Rayman Legends: Retold*, and *Tomb Raider: Legacy of Atlantis*. Many of these games are in early development stages, and the premature exposure of their achievement structures could give away design intentions or hint at gameplay milestones that developers intended to keep under wraps until official announcements.
GamesIndustry.biz has reached out to Valve for comment and further clarification. While Valve has not yet issued a formal statement regarding this specific achievement leak, the company has a recent history of dealing with security incidents. In July, Valve confirmed that personal data belonging to European customers was compromised after a breach at CEVA Logistics, the regional shipping partner responsible for distributing Steam hardware. The attack on CEVA occurred between July 29 and August 1, and Valve became aware of the intrusion on August 7.
The current achievement exposure raises several concerns for both developers and the broader gaming community. For developers, achievement lists often serve as a roadmap for player progression and can reveal key narrative beats, boss encounters, or secret content. When these details become public ahead of schedule, they can diminish the surprise factor that many studios carefully cultivate. Moreover, the premature visibility of achievement IDs could potentially be exploited by malicious actors seeking to manipulate leaderboards or create unauthorized mods.
For players, the leak provides a rare glimpse into the future of the Steam ecosystem. Enthusiasts can now see which upcoming games will support the achievement system, a feature that has become a cultural touchstone for many gamers.
Some may view this as a boon, allowing them to plan future purchases or set personal goals in anticipation of a game's release. Others, however, may feel that the surprise and mystery surrounding unreleased titles have been compromised.
From a technical standpoint, the incident underscores the importance of robust API permission handling. Steam's public API is a powerful tool that enables third‑party services to enrich the player experience, but it also requires strict access controls to prevent unintended data exposure. Valve's maintenance scripts likely altered a flag that determines whether achievement data is marked as "public" or "private," inadvertently flipping it for all titles regardless of their launch status. In response to the situation, Exophase has already begun scrubbing the newly surfaced entries from its database and is working with Valve to understand the scope of the bug.
SteamDB, another popular tracker, has issued a brief notice indicating that they are monitoring the issue and will remove any entries that violate Steam's privacy expectations once Valve resolves the underlying problem. The broader lesson for the industry is clear: even routine updates can have far‑reaching consequences when they intersect with large, automated data pipelines. Companies that expose APIs must implement safeguards that differentiate between public and confidential data, especially for content that is still in development. As the community awaits a formal response from Valve, the incident serves as a reminder that the line between transparency and inadvertent disclosure can be thin, and that vigilance is required to keep unreleased game information under the appropriate level of secrecy.