In a surprising turn of events, achievement data for several games that have not yet been released—or even officially announced—has surfaced on public tracking services such as Exophase and SteamDB. The leak includes titles that fans have been eagerly anticipating, such as the next installment of the Fable series, Persona 6, Kingdom Hearts IV, and the upcoming Control: Resonant expansion.
The issue was first highlighted by Simon Carless, the founder of GameDiscoverCo, who explained that Valve inadvertently introduced a significant bug during its routine weekly maintenance window. According to Carless, the bug caused the Steam achievement system to expose information that is normally kept private until a game launches or is formally announced. As a result, automated crawlers that power achievement‑tracking sites began pulling data for every Steam title that possesses an achievement set, regardless of its development status.
"Valve unfortunately rolled out a major bug around achievements after its weekly maintenance window," Carless said. "As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased… or even unannounced." Mike Bendel, the owner of Exophase, clarified that the situation stems from a mistake on Valve’s side rather than a deliberate data breach. In a response to a user query on the ResetEra forum, Bendel noted, "A bunch of games with achievements that should be private are accessible through the API right now and that's why they got scanned into the site.
I usually never see games without an actual name pop up with achievements, yet over the past hour or so a bunch have (when there's an unknown name we just set it to the AppID)." The exposure is not limited to the high‑profile titles previously mentioned. According to reporting by Gematsu, a wide array of other projects were also caught in the sweep. These include: - **Gears of War: E‑Day** – a new entry in the long‑running shooter franchise.
- **Clutch** – an indie title that has been generating buzz for its innovative gameplay mechanics. - **Horizon Hunters Gathering** – a spin‑off of the popular Horizon series.
- **Ace Combat 8** – the anticipated continuation of the aerial combat saga. - **Metro 2039** – a sequel that promises to expand the post‑apocalyptic universe.
- **Star Wars: Galactic Racer** – a racing game set in the Star Wars galaxy. - **Stranger Than Heaven** – an upcoming narrative‑driven adventure. - **Rayman Legends: Retold** – a refreshed version of the beloved platformer.
- **Tomb Raider: Legacy of Atlantis** – a new chapter in the iconic Lara Croft series. These titles span a variety of genres and development stages, illustrating how broadly the bug affected Valve’s achievement database. The fact that even games still in early development or merely conceptual phases were listed suggests that the achievement framework on Steam is populated far earlier in the production pipeline than many users might expect. GamesIndustry.biz has reached out to Valve for comment and further clarification on the scope of the incident.
While Valve has not yet issued a formal statement addressing this particular bug, the company’s track record with data‑related incidents provides some context. In July, Valve confirmed that personal information belonging to European customers had been compromised after a breach at CEVA Logistics, the regional shipping partner responsible for delivering Steam hardware. The attack on CEVA took place between July 29 and August 1, and Valve became aware of the breach on August 7.
The earlier CEVA incident underscores the importance of robust security practices not only within Valve’s own infrastructure but also among its third‑party vendors. Although the achievement leak appears to be a technical oversight rather than a malicious intrusion, the incident raises questions about how much internal data is exposed through public APIs and what safeguards are in place to prevent unintended disclosures. From a developer’s perspective, the premature exposure of achievement lists can have several ramifications. Achievements are often used as a marketing tool, building hype and giving players a glimpse of the challenges awaiting them.
When these details are revealed too early, they can diminish the surprise factor and potentially affect player expectations. Moreover, achievement design is frequently tweaked up until the final stages of development; early leaks could lead to misinformation spreading across forums and social media, complicating the communication strategy for studios. For players, the leak offers a mixed bag. On one hand, it satisfies the curiosity of fans eager for any scrap of information about upcoming games.
On the other hand, it can lead to speculation and rumors that may not reflect the final product. Community sites like Exophase and SteamDB serve as valuable resources for tracking progress, but they also amplify any data that slips through unintended channels. Looking ahead, Valve is expected to patch the bug that allowed the achievement API to be queried for unreleased titles.
The company’s engineering team will likely review the API permissions and implement stricter checks to ensure that only publicly released games have their achievement data exposed. In addition, Valve may consider adding a flag that explicitly marks achievement sets as private until a developer decides to make them public. In the meantime, the gaming community will continue to monitor the affected tracking sites for any updates. As more titles are identified, it will become clearer just how extensive the leak was and whether any other hidden data—such as in‑game statistics or leaderboards—might have been inadvertently captured.
The incident serves as a reminder that even well‑established platforms like Steam can encounter unforeseen technical glitches, and that transparency about such issues is essential for maintaining trust among developers and players alike.